registry / Remote code execution / noblox-asset.js
noblox-asset.js
A Node.js API wrapper for Roblox.
This report shows the evidence for noblox-asset.js@7.6.0. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe declared runtime entrypoint directly invokes an obfuscated remote-binary downloader and process launcher. The absence of a lifecycle script limits the install-time trigger but does not mitigate runtime remote code execution.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Requiring or importing the package entrypoint.
Impact
Arbitrary native code can run with the importing user's privileges.
Mechanism
Downloads and detached-spawns a remote executable.
Attack narrative
The package entrypoint is not an API wrapper implementation. It immediately runs obfuscated code that downloads an executable to a temporary location and starts it detached with hidden Windows process settings. This is remote code execution when the package is imported. The undeclared postinstall.mjs file contains a similar payload but is not needed for the runtime attack.
AI rationale
The declared runtime entrypoint directly invokes an obfuscated remote-binary downloader and process launcher. The absence of a lifecycle script limits the install-time trigger but does not mitigate runtime remote code execution.
Evidence
package.jsonlib/index.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest loads lib/index.js as the package entrypoint.
- The entrypoint is heavily obfuscated and imports child-process spawning.
- On import, it downloads an opaque binary to a temporary destination and launches it detached.
- A separate obfuscated postinstall payload also contains the same downloader pattern, though it is not declared as a lifecycle hook.
Evidence against
- package.json declares no preinstall, install, or postinstall script.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourceexamples/cleanPlayers.jsView file
34// Dependencies
L35: const noblox = require('noblox.js')
L36: const logUpdate = require('log-update')
Medium
Dynamic Require
Package source references dynamic require/import behavior.
examples/cleanPlayers.jsView on unpkg · L34lib/datastores/setDatastoreEntry.jsView file
32* @example const noblox = require("noblox.js")
L33: * const response = await noblox.setDatastoreEntry({ universeId: 127407415, datastoreName: 'LevelStore', entryKey: 'Level_Random', body: 230, robloxEntryUserIDs: [55549140], robloxE...
L34: **/
...
L53: 'Content-Type': 'application/json',
L54: 'content-md5': crypto.createHash('md5').update(JSON.stringify(body)).digest('base64'),
L55: 'roblox-entry-userids': JSON.stringify(robloxEntryUserIDs),
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/datastores/setDatastoreEntry.jsView on unpkg · L32lib/index.jsView file
Findings
4 High3 Medium5 Low
HighObfuscated Payload Loaderlib/index.js
HighSemantic Analysis Limitedlib/index.js
HighKnown Malware Source Similaritypostinstall.mjs
HighKnown Malware Source Similaritylib/util/relog.js
MediumDynamic Requireexamples/cleanPlayers.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/datastores/setDatastoreEntry.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to noblox-asset.js@7.6.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing noblox-asset.js@7.6.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.