MAL-2026-13630
Malicious code in @rbx-ts/services (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126) scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for @rbx-ts/services (npm). Pin to a known-safe version or switch to an alternative.