@rbxst/services@1.0.756

Analysis

The package's postinstall hook (scripts/postinstall.js) is a Windows-targeted multi-stage dropper. On Windows installs it downloads a ZIP archive from hxxps://files[.]catbox[.]moe/rp8idk[.]zip into the temp directory, extracts it with PowerShell Expand-Archive, then launches a detached, hidden pythonw.exe process that runs an exec_.py script from the extracted archive, and finally deletes the ZIP. This downloads and executes an unknown remote payload at install time.