MAL-2026-16059

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b) The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a VBScript from the hardcoded URL https://l81.me/updater.vbs, writes it to %APPDATA%\Rojo\rojo-sync.vbs, and executes it hidden via wscript.exe //B. The script then adds an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named RojoClientSync that re-launches the dropped VBS on every user login, giving the fetched payload boot persistence independent of the package. The remote URL, wscript.exe, //B flag, target directory, file name, registry path, and value name are all reconstructed at runtime from String.fromCharCode numeric arrays via a _d() helper to evade static review. The shipped bin only prints --version/--help and provides no functional Rojo CLI; the manifest points at github.com/Unreal-Works/rojo-npm rather than the real rojo-rbx/rojo project. The dropper is the package's only real behavior.