Malicious code in @rblxts/services (npm)

The malicious package @rblxts/services was published to npm as a typosquatting attack against the legitimate @rbxts/services roblox-ts library. The package's README and index.js mimic the legitimate package's API surface to avoid immediate detection.\n\nThe attack vector is a postinstall script (scripts/postinstall.js) that deliberately obfuscates core Node.js API names ('fs', 'https', 'child_process', 'powershell', '.exe') using hex encoding and base64-encodes a hardcoded URL. When decoded, the URL points to https://files.catbox.moe/9bppy2.zip, an anonymous and mutable file host.\n\nOn Windows systems, the script downloads the ZIP file to %TEMP%, extracts it using PowerShell's Expand-Archive command, recursively walks the extracted directory tree, and spawns any .exe files found using child_process.spawn with detached, windowsHide, and stdio-ignored options to avoid user visibility. The ZIP file is then deleted. No hash or signature verification is performed on the downloaded content.\n\nThe obfuscation of API names and the URL is a deliberate evasion technique targeting automated registry scanners. The incident was identified and credited to the OpenSSF malicious-packages project.