{"answers":{"affected":"1 open source package ship an affected version, including rojo-rbx.","exploited":"There is no known exploitation of MAL-2026-16059 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16059 is a malicious package in rojo-rbx, published on 9 Sep 2026."},"fix_prompt":"MAL-2026-16059 is a malicious package: rojo-rbx (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16059/ (Markdown: https://insights.sbomify.com/MAL-2026-16059/index.md)","id":"MAL-2026-16059","markdown":"https://insights.sbomify.com/MAL-2026-16059/index.md","name":"MAL-2026-16059","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a VBScript from the hardcoded URL https://l81.me/updater.vbs, writes it to %APPDATA%\\Rojo\\rojo-sync.vbs, and executes it hidden via wscript.exe //B. The script then adds an HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry named RojoClientSync that re-launches the dropped VBS on every user login, giving the fetched payload boot persistence independent of the package. The remote URL, wscript.exe, //B flag, target directory, file name, registry path, and value name are all reconstructed at runtime from String.fromCharCode numeric arrays via a _d() helper to evade static review. The shipped bin only prints --version/--help and provides no functional Rojo CLI; the manifest points at github.com/Unreal-Works/rojo-npm rather than the real rojo-rbx/rojo project. The dropper is the package's only real behavior.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in rojo-rbx (npm)","id":"MAL-2026-16059","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"rojo-rbx","purl":"pkg:npm/rojo-rbx","source":"MAL-2026-16059"}],"products":null,"published":"2026-09-09","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16059/"}