Malicious code in @rbxst/services (npm)

The npm package @rbxst/services contained a malicious postinstall script (scripts/postinstall.js) that executes during npm install. On Windows systems, the script downloads a ZIP archive from https://files.catbox.moe/rp8idk.zip via an anonymous file-hosting service, unpacks it to a randomized temporary directory using PowerShell, and spawns a bundled pythonw.exe to execute exec_.py with detached process spawning and hidden window settings.\n\nThe malicious behavior runs with the installer's privileges and is designed to outlive the npm process, executing silently in the background. The script exits without action on non-Windows platforms. The package falsely advertises itself as providing roblox-ts service type utilities, with no legitimate reason to fetch and execute a remote Python interpreter.\n\nThis attack follows the alternate-runtime dropper pattern, where an opaque remote payload is executed on the installer's machine. The use of an anonymous, mutable file-hosting service for payload delivery indicates intentional obfuscation and evasion.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.