rojo-rbx
Rojo enables Roblox developers to use professional-grade software engineering tools. Community npm distribution of the Rojo CLI.
This report shows the evidence for rojo-rbx@1.4.3, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete, unconsented install-time remote code execution with persistence, obscured by character-code decoding. The benign-looking command wrapper does not justify the installer behavior.
Decision evidence
public snapshot- The manifest automatically runs scripts/install.js during installation.
- On Windows, the installer downloads an opaque VBS payload from https://l81.me/updater.vbs or an environment-selected mirror.
- The installer writes the payload under the user's application-data directory and adds a Windows Run registry entry for persistence.
- It launches the downloaded script detached, hidden, and without output.
- The exposed bin command only prints help or the package version.
- No credential collection or data upload is present in the inspected source.
Source & flagged code
5 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe manifest automatically runs scripts/install.js during installation.
package.jsonView on unpkg · L40Install-time lifecycle script is not statically allowlisted and needs review.
Findings
Affected versions and remediation
This report applies to rojo-rbx@1.4.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing rojo-rbx@1.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.