MAL-2026-16059

    Dashboard / Malicious Package / MAL-2026-16059

    MAL-2026-16059

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in rojo-rbx (npm)

    Details: Source: amazon-inspector (8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b) The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a VBScript from the hardcoded URL https://l81.me/updater.vbs, writes it to %APPDATA%\Rojo\rojo-sync.vbs, and executes it hidden via wscript.exe //B. The script then adds an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named RojoClientSync that re-launches the dropped VBS on every user login, giving the fetched payload boot persistence independent of the package. The remote URL, wscript.exe, //B flag, target directory, file name, registry path, and value name are all reconstructed at runtime from String.fromCharCode numeric arrays via a _d() helper to evade static review. The shipped bin only prints --version/--help and provides no functional Rojo CLI; the manifest points at github.com/Unreal-Works/rojo-npm rather than the real rojo-rbx/rojo project. The dropper is the package's only real behavior.

    References: https://www.npmjs.com/package/rojo-rbx/v/1.4.3

    Affected packages

    Package

    Name: rojo-rbx

    Purl: pkg:npm/rojo-rbx

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.4.3