The npm package @rblxts/services is a typosquatting malicious package impersonating @rbxts/services. Its postinstall script is heavily obfuscated and downloads a zip archive from an anonymous file hosting service, which it unpacks into a Microsoft-lookalike directory on Windows systems. It then executes a bundled Python script in a hidden and detached manner, potentially executing malicious code without user awareness. This behavior occurs automatically upon npm install of affected versions.