MAL-2026-13691
Malicious code in @rblxts/services (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0) @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names ('fs','https','child_process'), environment variable names, filenames, and the download URL are stored as \x hex escapes or base64 to hide them from string scanners. On Windows, the postinstall decodes a base64 URL to https://files.catbox.moe/vpfwzj.zip, downloads the archive, uses PowerShell Expand-Archive to unpack it into a randomly-named directory under %LOCALAPPDATA%\Microsoft, and then spawns a bundled pythonw.exe against exec_.py with detached:true, windowsHide:true and stdio ignored, unref'd from the installer process. The delivery host (files.catbox.moe) is an anonymous file locker, the URL is not pinned by hash, the staging path is hidden under a Microsoft-lookalike directory, and the entire chain fires automatically on npm install.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @rblxts/services (npm). Pin to a known-safe version or switch to an alternative.