MAL-2026-13630

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rbx-ts/services/MAL-2026-13630.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13630
Published
2026-08-08T00:47:57Z
Modified
2026-08-08T01:04:57.248320504Z
Summary
Malicious code in @rbx-ts/services (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126)

scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-08T00:47:57Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017169",
            "import_time": "2026-08-08T00:53:08.316135645Z",
            "sha256": "22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126",
            "versions": [
                "1.6.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @rbx-ts/services

Package

Name
@rbx-ts/services
View open source insights on deps.dev
Purl
pkg:npm/%40rbx-ts/services

Affected ranges

Affected versions

1.*
1.6.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "services-1.6.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-PF6HVUS7ZgAkXwukJpT63sw3DeUU+XrbVchIGFupy/qHc053NfRim0OqIp617MSx9F1S70/UiyRpWHYseTGrIA==",
                "sha1": "cbb5f3757708a5d3f71a44f63c5d83d829b58744"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "67412fd971d5632b23ec08e3f5156ae985e79e12b0cab883c36c7e4d08e904fc6e19c5",
            "sha256": "af2a3ec64c75eec719b07d98183f390f18ff63021b67d832729e28adfbe37ba0",
            "path": "scripts/postinstall.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rbx-ts/services/MAL-2026-13630.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]