The @rbx-ts/services npm package version 1.6.0 includes a postinstall.js script that is obfuscated using hex-escaped identifiers and base64-encoded strings to conceal standard Node.js API usage and a download URL. When installed on Windows platforms, the script decodes a base64 URL pointing to https://files.catbox.moe/9bppy2.zip, downloads this archive to the system TEMP directory, extracts it using PowerShell's Expand-Archive, searches for the first .exe file in the extracted content, and executes it detached from the installation process before deleting the archive. The package's legitimate purpose is to provide Roblox TypeScript type definitions, which do not require executing Windows binaries, indicating malicious intent. The file host used allows attacker-controlled mutable content without integrity verification, increasing risk.

This malicious behavior enables arbitrary code execution on Windows systems during package installation, potentially allowing attackers to run any code with the privileges of the user performing the npm install. This can lead to system compromise, data theft, or further malware deployment. Since the executable is downloaded from an untrusted, mutable source without verification, the payload can be changed by attackers at any time, increasing the threat.

No official patch or remediation is currently documented. Users should avoid installing @rbx-ts/services version 1.6.0. Verify package integrity and source before installation. Consider using package integrity verification tools and restrict npm package installation to trusted sources. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.