noblox-asset.js@7.4.1
Malicious code in noblox-asset.js (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1082 · System Information DiscoveryT1059.001 · PowerShellT1071.001 · Web ProtocolsT1195.002 · Compromise Software Supply Chain
Analysis
The postinstall hook (postinstall.mjs) is an obfuscated Windows dropper. It performs extensive virtual-machine and analysis-environment detection (VirtualBox/VMware/Parallels/QEMU driver and registry checks, MAC-address prefixes, boot-time and debugger/process checks) and, if the environment is deemed real, downloads a binary from hxxps://trlxgames[.]netlify[.]app/TRLX[.]exe to the system temp directory and executes it. The package is a clone of the legitimate noblox.js Roblox API wrapper with this malicious install-time payload injected.
- analyzed by
- Leitwacht
- first seen
- Sep 12, 2026, 05:47 PM
- analyzed
- Sep 12, 2026, 05:47 PM
Related advisories
- node-helper@1.5.4
- @stellarshift/chain-metadata@1.0.1
- @stellarshift/evm-address-kit@1.0.1
- moidevy@1.0.0
- dev-env-check@1.0.3
- sbirontime@1.0.0
- testingsmthb1g@1.0.0
- @biklitime/biklimaster@1.1.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.