@rbx-ts/services@1.6.0
Malicious code in @rbx-ts/services (npm)
T1059.007 · JavaScriptT1059.001 · PowerShellT1105 · Ingress Tool Transfer
Analysis
The postinstall hook (scripts/postinstall.js) is a Windows-only dropper. On win32 it downloads a zip archive from a remote URL into %TEMP%, extracts it with PowerShell Expand-Archive, recursively scans the extracted directory, and launches every .exe it finds as a detached process, then deletes the zip. Installing this package on Windows downloads and executes an arbitrary remote binary.
- analyzed by
- Leitwacht
- first seen
- Aug 7, 2026, 07:22 PM
- analyzed
- Aug 7, 2026, 07:26 PM
Related advisories
- wormgpt-cli@1.0.1
- dolyame-ui-swiper@35.7.7
- stellarfixer@1.0.0
- approval-guardian@1.0.8
- warp-drive-internal-tooling@99.9.9
- mcp-audit-sync-internal@99.9.9
- native-hello-plugin@1.2.0
- fdd41@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.