MAL-2026-13691

    Dashboard / Malicious Package / MAL-2026-13691

    MAL-2026-13691

    Published: 10 Aug 2026Last Modified: 10 Aug 2026

    Summary: Malicious code in @rblxts/services (npm)

    Details: Source: amazon-inspector (f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0) @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names ('fs','https','child_process'), environment variable names, filenames, and the download URL are stored as \x hex escapes or base64 to hide them from string scanners. On Windows, the postinstall decodes a base64 URL to https://files.catbox.moe/vpfwzj.zip, downloads the archive, uses PowerShell Expand-Archive to unpack it into a randomly-named directory under %LOCALAPPDATA%\Microsoft, and then spawns a bundled pythonw.exe against exec_.py with detached:true, windowsHide:true and stdio ignored, unref'd from the installer process. The delivery host (files.catbox.moe) is an anonymous file locker, the URL is not pinned by hash, the staging path is hidden under a Microsoft-lookalike directory, and the entire chain fires automatically on npm install.

    References: https://www.npmjs.com/package/@rblxts/services/v/1.6.2, https://www.npmjs.com/package/@rblxts/services/v/1.6.0

    Affected packages

    Package

    Name: @rblxts/services

    Purl: pkg:npm/%40rblxts/services

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.6.2
    1.6.0
    MAL-2026-13691 | CVE-DB