{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "scripts/postinstall.js",
              "sha256": "af2a3ec64c75eec719b07d98183f390f18ff63021b67d832729e28adfbe37ba0",
              "tlsh": "67412fd971d5632b23ec08e3f5156ae985e79e12b0cab883c36c7e4d08e904fc6e19c5"
            }
          ],
          "package_integrity": [
            {
              "filename": "services-1.6.0.tgz",
              "hashes": {
                "sha1": "cbb5f3757708a5d3f71a44f63c5d83d829b58744",
                "sha512_sri": "sha512-PF6HVUS7ZgAkXwukJpT63sw3DeUU+XrbVchIGFupy/qHc053NfRim0OqIp617MSx9F1S70/UiyRpWHYseTGrIA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@rbx-ts/services"
      },
      "versions": [
        "1.6.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017169",
        "import_time": "2026-08-08T00:53:08.316135645Z",
        "modified_time": "2026-08-08T00:47:57Z",
        "sha256": "22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126",
        "source": "amazon-inspector",
        "versions": [
          "1.6.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126)\nscripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names (\u0027https\u0027, \u0027fs\u0027, \u0027child_process\u0027, \u0027powershell\u0027, \u0027.exe\u0027) and a download URL. On npm install, if process.platform === \u0027win32\u0027, the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.\n",
  "id": "MAL-2026-13630",
  "modified": "2026-08-08T00:47:57Z",
  "published": "2026-08-08T00:47:57Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@rbx-ts/services/v/1.6.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @rbx-ts/services (npm)"
}