{"id":"MAL-2026-16059","summary":"Malicious code in rojo-rbx (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b)\nThe package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a VBScript from the hardcoded URL https://l81.me/updater.vbs, writes it to %APPDATA%\\Rojo\\rojo-sync.vbs, and executes it hidden via wscript.exe //B. The script then adds an HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry named RojoClientSync that re-launches the dropped VBS on every user login, giving the fetched payload boot persistence independent of the package. The remote URL, wscript.exe, //B flag, target directory, file name, registry path, and value name are all reconstructed at runtime from String.fromCharCode numeric arrays via a _d() helper to evade static review. The shipped bin only prints --version/--help and provides no functional Rojo CLI; the manifest points at github.com/Unreal-Works/rojo-npm rather than the real rojo-rbx/rojo project. The dropper is the package's only real behavior.\n","modified":"2026-09-09T01:45:05.121223673Z","published":"2026-09-09T00:47:56Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-09T00:47:56Z","sha256":"8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b","source":"amazon-inspector","versions":["1.4.3"],"id":"IN-MAL-2026-019731","import_time":"2026-09-09T01:28:58.424633339Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/rojo-rbx/v/1.4.3"}],"affected":[{"package":{"name":"rojo-rbx","ecosystem":"npm","purl":"pkg:npm/rojo-rbx"},"versions":["1.4.3"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"4c6174cfa79a2321a172b0fc817f8c1976b2d0122161da90f9dc92676f7057c0a36cf8","path":"scripts/install.js","sha256":"24c6e79f2a38b22c5eaeefd4ce2208660c60b441b837d08e690230620e7cc150"},{"path":"package.json","sha256":"3f203c1c6777023d0ef1560b34e0b2228523ad15b9192b2cf5cda4f359e8a25c","tlsh":"af113462cc701e2b2ee425a4e876214af5690d838c24fc3533d3912cab8d16b13be9dd"}],"package_integrity":[{"filename":"rojo-rbx-1.4.3.tgz","hashes":{"sha512_sri":"sha512-sEzaTUJzfKF95vUJWbSKTOkuH4fG4cWyrhylna1Q3PWogOGrrx+RwLHGHapgv4E3jxNs/HddiBoTPgSIy3rfhQ==","sha1":"7c909669854984add7f6d5b24b3cc54c58e16fd7"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rojo-rbx/MAL-2026-16059.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}