npm · Malicious package advisory
Malware@rbx-ts/services
GHSA-2846-4m8r-rvv5
Malicious code in @rbx-ts/services (npm)
Details
**Severity:** Critical
**Affected versions:** `= 1.6.0`
## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126)
scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/@rbx-ts/services/MAL-2026-13630.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/@rbx-ts/services/MAL-2026-13630.json
- https://www.npmjs.com/package/@rbx-ts/services/v/1.6.0
- https://github.com/advisories/GHSA-2846-4m8r-rvv5Compromised versions (1)
- = 1.6.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.