Evolving npm Package Campaign Targets Roblox Devs, for Years

Researchers report an ongoing supply-chain campaign (active since at least August 2023) in which attackers publish malicious npm packages that mimic the popular noblox.js library to target Roblox game developers. The packages deliver Luna Grabber and other payloads (including QuasarRAT), steal Discord tokens and system data, use obfuscated postinstall code and typosquatting/starjacking to appear legitimate, add registry-based persistence tied to the Windows Settings app, and attempt to disable third-party and built-in antivirus protections; despite takedowns, malicious packages continue to appear on the npm registry.