@rblxts/services

{"schema_version":"1.7.4","id":"MAL-2026-13691","published":"2026-08-10T12:23:43Z","modified":"2026-08-10T12:53:37.614699350Z","summary":"Malicious code in @rblxts/services (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0)\n@rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names ('fs','https','child_process'), environment variable names, filenames, and the download URL are stored as \\x hex escapes or base64 to hide them from string scanners. On Windows, the postinstall decodes a base64 URL to https://files.catbox.moe/vpfwzj.zip, downloads the archive, uses PowerShell Expand-Archive to unpack it into a randomly-named directory under %LOCALAPPDATA%\\Microsoft, and then spawns a bundled pythonw.exe against exec_.py with detached:true, windowsHide:true and stdio ignored, unref'd from the installer process. The delivery host (files.catbox.moe) is an anonymous file locker, the URL is not pinned by hash, the staging path is hidden under a Microsoft-lookalike directory, and the entire chain fires automatically on npm install.\n","affected":[{"package":{"name":"@rblxts/services","ecosystem":"npm"},"versions":["1.6.2","1.6.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"992587072f0bb3a59f926fc3ba2bad78bb45bb23664fa36b23c8f03c7dd0b8e0","tlsh":"cf41f0d571d5632b23ed44e7f6245ee581a7dd12b0cab043836c7a0d18d908acae59c9"},{"path":"package.json","sha256":"543a23b2d7ace599ac6bdad5742a020649870822ded64ecfd95ba55513be1eb7","tlsh":"69f0f0308c519a7339c41aa9dc6a2002a5590c1b5c55bd5877e3712c8fde6af05ff2ef"}],"package_integrity":[{"filename":"services-1.6.2.tgz","hashes":{"sha1":"1ef75d8d97543c1e1ff80ca23388dae96eab8260","sha512_sri":"sha512-2MaON+tHzpUG4I62Zadd3tDUbeG9Ldpk6WNC1qts1KnoJm8+42gllgn8bKi1h2U+Xn04p2w9kHlKUcdiuTA8bw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@rblxts/services/v/1.6.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@rblxts/services/v/1.6.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017255","import_time":"2026-08-10T12:24:47.141166332Z","modified_time":"2026-08-10T12:23:43Z","sha256":"493084027acef5e5ee72f7f86aee9c3dd6d901c10ddb013645b5594ca0fbb672","source":"amazon-inspector","versions":["1.6.2"]},{"id":"IN-MAL-2026-017260","import_time":"2026-08-10T12:51:44.746114136Z","modified_time":"2026-08-10T12:25:41Z","sha256":"f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0","source":"amazon-inspector","versions":["1.6.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}