MAL-2026-16148

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/noblox-asset.js/MAL-2026-16148.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16148
Published
2026-09-14T16:56:44Z
Modified
2026-09-14T17:30:06Z
Summary
Malicious code in noblox-asset.js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973)

noblox-asset.js impersonates the noblox.js Roblox API wrapper: package.json copies the legitimate package's description, homepage (github.com/noblox/noblox.js), and repository metadata while shipping a heavily obfuscated postinstall.mjs. On npm install, the postinstall script performs sandbox-evasion checks (recent-boot gating <15 minutes, parent-process allowlist, running-process checks for x64dbg/ollydbg/ida/procmon, VirtualBox/VMware/QEMU/Xen/Parallels/Hyper-V registry/driver/MAC-OUI checks) and, on non-sandbox hosts, downloads https://trlxgames.netlify.app/TRLX.exe to os.tmpdir()/NOBLOX_CLI.exe and spawns it detached with stdio ignored and unref, so the process survives after npm exits. The download destination is unrelated to the impersonated project's publisher, the binary is unpinned and unverified, and the script uses obfuscator.io-style _0xNNNN string-array indirection to hide the flow.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020036",
            "import_time": "2026-09-14T17:15:21.946105526Z",
            "modified_time": "2026-09-14T16:56:55Z",
            "sha256": "68b7f250c46da578e89217e966bacbfec497fd6638e913f41d5dfa6e1e22c12c",
            "source": "amazon-inspector",
            "versions": [
                "7.4.2"
            ]
        },
        {
            "id": "IN-MAL-2026-020038",
            "import_time": "2026-09-14T17:15:22.137046788Z",
            "modified_time": "2026-09-14T16:57:14Z",
            "sha256": "6b13963f0e6e8eb0236e39290fa51db8a0006f0588b739a19418e8069b458a1d",
            "source": "amazon-inspector",
            "versions": [
                "7.6.0"
            ]
        },
        {
            "id": "IN-MAL-2026-020037",
            "import_time": "2026-09-14T17:15:22.034722327Z",
            "modified_time": "2026-09-14T16:57:04Z",
            "sha256": "a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973",
            "source": "amazon-inspector",
            "versions": [
                "7.4.0"
            ]
        },
        {
            "id": "IN-MAL-2026-020035",
            "import_time": "2026-09-14T17:15:21.857152462Z",
            "modified_time": "2026-09-14T16:56:44Z",
            "sha256": "d8d7f36ff3b9eaa9aea145839ae54630f80efc00363417b8808b09e5c3f8a7cc",
            "source": "amazon-inspector",
            "versions": [
                "7.4.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / noblox-asset.js

Package

Name
noblox-asset.js
View open source insights on deps.dev
Purl
pkg:npm/noblox-asset.js

Affected ranges

Affected versions

7.*
7.4.0
7.4.1
7.4.2
7.6.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.mjs",
            "sha256": "af4fe4b7f908d229b5c50d05a4011adc8fe1812e5ea5e9e516f3f0839c8c8f74",
            "tlsh": "918362c273c1b88522474773b727b1e5e52e5de8708808cff584bc50f8aa526fae5678"
        },
        {
            "path": "package.json",
            "sha256": "d7119f654d5c4a62771d4d03c4abd171877d668bc461b8f133a05ac08070f3e1",
            "tlsh": "5f31ab21c8289de33ac9b699985a0052a66048438d64fc1d73cf631c4f0e17f26fe6ed"
        }
    ],
    "package_integrity": [
        {
            "filename": "noblox-asset.js-7.4.2.tgz",
            "hashes": {
                "sha1": "39a5a1f3d37ea49cebac7163cf1a359312b16ad9",
                "sha512_sri": "sha512-XW76dHGK9p12L4UAlGgD7ApUTTstepodrBz9Db71irKeLWPaffFyN6uclGfQwGLVhO3xvn9xRFauPCT/ROw4EA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/noblox-asset.js/MAL-2026-16148.json"