MalwarePublished 10 Aug 2026

@rblxts/services (npm) · Malicious Code

Affects @rblxts/servicesSource GCVE Database

Malicious package : remove @rblxts/services and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 15:42 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13691

What to do

Remove @rblxts/services from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@rblxts/services	Affected =1.6.2 =1.6.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @rblxts/services is a typosquatting malicious package impersonating @rbxts/services. Its postinstall script is heavily obfuscated and downloads a zip archive from an anonymous file hosting service, which it unpacks into a Microsoft-lookalike directory on Windows systems. It then executes a bundled Python script in a hidden and detached manner, potentially executing malicious code without user awareness. This behavior occurs automatically upon npm install of affected versions.

Impact

This malicious package can execute arbitrary code on Windows systems during npm install without user consent or awareness. The obfuscation and use of anonymous file hosting complicate detection and analysis. The execution of a detached Python process allows the attacker to run further malicious actions on the affected system. There is no indication of active exploitation in the wild, but the potential for compromise is significant due to automatic execution.

Defensive guidance

Users should avoid installing the @rblxts/services package versions 1.6.0 and 1.6.2. Since this is a typosquatting package impersonating @rbxts/services, verify package names carefully before installation. Remove any installations of these versions and scan affected systems for the downloaded payload and related artifacts under %LOCALAPPDATA%\Microsoft. Monitor npm package sources for updates or advisories.

Summary

The @rblxts/services npm package versions 1.6.0 and 1.6.2 contain malicious code in their postinstall.js script. This script uses obfuscation techniques to hide module names, environment variables, filenames, and a download URL encoded in hex and base64. On Windows, it downloads a zip archive from https://files.catbox.moe/vpfwzj.zip, extracts it into a randomly named directory under %LOCALAPPDATA%\Microsoft, and executes a bundled pythonw.exe with a script exec_.py in a detached, hidden process. The download URL is not pinned by hash, and the staging path mimics a legitimate Microsoft directory to evade detection. This chain executes automatically during npm install, enabling silent execution of potentially malicious payloads.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 15:42 UTC

Technical details

References

Community reviews