A malicious npm package named node-dlls v1.0.0 uses a heavily obfuscated postinstall hook to silently download and execute a Windows executable disguised as RobloxPlayerLauncher.exe from a GitHub-hosted stager repository. Armando identified this package as part of a cluster of Roblox-themed supply chain packages targeting npm developers, and it has since been removed from the npm registry. The package accumulated 77 downloads before takedown.
Key Findings
- Malicious version: v1.0.0, published 2024-10-23; no clean version exists -- this package was malicious from the first upload
- Entry point: postinstall lifecycle hook fires automatically on npm install
- Targets: Windows systems running Node.js -- the hook invokes PowerShell to fetch and execute a PE payload named RobloxPlayerLauncher.exe
- Evasion: The entire attack logic is protected by multi-layer JavaScript obfuscation (string-array rotation with arithmetic self-tests); no plaintext URLs appear in the source
- Detection: Script-JS.Downloader.SupplyChain, Text.Downloader.SupplyChain
Package Background
node-dlls advertised itself as an "Advanced kernel package" -- a description that carries no practical meaning and was never backed by any source code repository or documentation. Published on 2024-10-23 under the npm account lvck, the package has only a single version (1.0.0), which is itself a strong indicator of a purpose-built attacker account. The package had 77 total downloads and zero declared dependents before npm removed it from the registry.
The name node-dlls is chosen to suggest a low-level Windows integration package to developers working on projects that interact with the Windows platform. The Roblox game engine runs on Windows and has an active developer and modding community that frequently uses npm tooling, making those developers a plausible target for a package carrying this name.
Attack Analysis
The attack chain is minimal and deliberate: a two-file package (package.json and index.js) where every line of the actual attack logic lives in the postinstall hook.
package.json declares "postinstall": "node index.js" in its scripts block. That single line is the trigger: any developer running npm install node-dlls causes Node.js to execute index.js immediately, without any additional user interaction. The package has no declared source repository, no legitimate entry points for library users, and no meaningful exported API -- its entire value proposition from the attacker's perspective is that one scripts line.
%22%3E%0A%20%20%20%20%20%20%3Crect%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%23f2930d%22%2F%3E%0A%20%20%20%20%20%20%3Crect%20x%3D%2210%22%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%230d0d0d%22%2F%3E%0A%20%20%20%20%3C%2Fpattern%3E%0A%20%20%3C%2Fdefs%3E%0A%20%20%3Crect%20width%3D%221200%22%20height%3D%226%22%20fill%3D%22url(%23caution-stripe)%22%2F%3E%0A%3C%2Fsvg%3E){kind=small}