YEAR-LONG CAMPAIGN OF MALICIOUS NPM PACKAGES TARGETING ROBLOX USERS

Summary from the TLDR InfoSec newsletter

A long-running malware campaign is targeting Roblox developers through fake NPM packages mimicking "noblox.js". Attackers are using brandjacking and starjacking to appear legitimate and install malware that steals data, persists in systems, and deploys additional payloads to continue siphoning future data.