MAL-2026-13691

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rblxts/services/MAL-2026-13691.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13691
Published
2026-08-10T12:23:43Z
Modified
2026-08-10T13:05:04.392745559Z
Summary
Malicious code in @rblxts/services (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0)

@rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names ('fs','https','childprocess'), environment variable names, filenames, and the download URL are stored as \x hex escapes or base64 to hide them from string scanners. On Windows, the postinstall decodes a base64 URL to https://files.catbox.moe/vpfwzj.zip, downloads the archive, uses PowerShell Expand-Archive to unpack it into a randomly-named directory under %LOCALAPPDATA%\Microsoft, and then spawns a bundled pythonw.exe against exec.py with detached:true, windowsHide:true and stdio ignored, unref'd from the installer process. The delivery host (files.catbox.moe) is an anonymous file locker, the URL is not pinned by hash, the staging path is hidden under a Microsoft-lookalike directory, and the entire chain fires automatically on npm install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-10T12:24:47.141166332Z",
            "id": "IN-MAL-2026-017255",
            "sha256": "493084027acef5e5ee72f7f86aee9c3dd6d901c10ddb013645b5594ca0fbb672",
            "modified_time": "2026-08-10T12:23:43Z",
            "source": "amazon-inspector",
            "versions": [
                "1.6.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017260",
            "import_time": "2026-08-10T12:51:44.746114136Z",
            "sha256": "f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0",
            "versions": [
                "1.6.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-10T12:25:41Z"
        }
    ]
}
References
Credits

Affected packages

npm / @rblxts/services

Package

Name
@rblxts/services
View open source insights on deps.dev
Purl
pkg:npm/%40rblxts/services

Affected ranges

Affected versions

1.*
1.6.0
1.6.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rblxts/services/MAL-2026-13691.json"
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "tlsh": "cf41f0d571d5632b23ed44e7f6245ee581a7dd12b0cab043836c7a0d18d908acae59c9",
            "sha256": "992587072f0bb3a59f926fc3ba2bad78bb45bb23664fa36b23c8f03c7dd0b8e0"
        },
        {
            "path": "package.json",
            "tlsh": "69f0f0308c519a7339c41aa9dc6a2002a5590c1b5c55bd5877e3712c8fde6af05ff2ef",
            "sha256": "543a23b2d7ace599ac6bdad5742a020649870822ded64ecfd95ba55513be1eb7"
        }
    ],
    "package_integrity": [
        {
            "filename": "services-1.6.2.tgz",
            "hashes": {
                "sha1": "1ef75d8d97543c1e1ff80ca23388dae96eab8260",
                "sha512_sri": "sha512-2MaON+tHzpUG4I62Zadd3tDUbeG9Ldpk6WNC1qts1KnoJm8+42gllgn8bKi1h2U+Xn04p2w9kHlKUcdiuTA8bw=="
            }
        }
    ]
}