The @rblxts/services npm package versions 1.6.0 and 1.6.2 contain malicious code in their postinstall.js script. This script uses obfuscation techniques to hide module names, environment variables, filenames, and a download URL encoded in hex and base64. On Windows, it downloads a zip archive from https://files.catbox.moe/vpfwzj.zip, extracts it into a randomly named directory under %LOCALAPPDATA%\Microsoft, and executes a bundled pythonw.exe with a script exec_.py in a detached, hidden process. The download URL is not pinned by hash, and the staging path mimics a legitimate Microsoft directory to evade detection. This chain executes automatically during npm install, enabling silent execution of potentially malicious payloads.

This malicious package can execute arbitrary code on Windows systems during npm install without user consent or awareness. The obfuscation and use of anonymous file hosting complicate detection and analysis. The execution of a detached Python process allows the attacker to run further malicious actions on the affected system. There is no indication of active exploitation in the wild, but the potential for compromise is significant due to automatic execution.

Users should avoid installing the @rblxts/services package versions 1.6.0 and 1.6.2. Since this is a typosquatting package impersonating @rbxts/services, verify package names carefully before installation. Remove any installations of these versions and scan affected systems for the downloaded payload and related artifacts under %LOCALAPPDATA%\Microsoft. No official patch or fix is available; remediation involves removing the malicious package and associated files. Monitor npm package sources for updates or advisories.