The npm package @rbxst/services version 1.0.756 contains malicious code that executes during installation on Windows systems. The postinstall.js script downloads a ZIP archive from an anonymous file-hosting service, extracts it using PowerShell, and runs a hidden Python payload with the installer's privileges. This behavior is suspicious and matches known malicious patterns of remote payload execution. The package falsely advertises Roblox-TS service utilities but has no legitimate reason to fetch and run external Python code. This threat does not have a CVSS score but is assessed as high severity due to the execution of opaque remote code with user privileges.