
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
rbx-reader-rts
Advanced tools
A modern TypeScript library for parsing Roblox binary files (.rbxm, .rbxl) in Node.js and the browser. Provides utilities to extract Animation and Sound asset IDs and is easily extensible.
A modern TypeScript library for parsing Roblox binary files (.rbxm
, .rbxl
) in
Node.js or the browser. It extracts all instances, their properties and
provides convenience helpers for retrieving Animation IDs, Sound IDs and other
asset references. The parser is derived from the open‑source
rbx-reader
project with additional improvements and a more modern API.
.rbxm
/.rbxl
files using a TypeScript
implementation adapted from the original rbx-reader
project.InstanceRoot
and array of Instance
objects.AnimationId
and SoundId
, regardless of whether
they are written as a bare number or embedded in an rbxassetid://
URL.additionalExtractors
option to discover other kinds of asset references.npm install modern-rbx-parser
This package has no runtime dependencies. It can be used both in Node.js
and in browser environments that support ArrayBuffer
and typed arrays.
import { parseBuffer } from 'modern-rbx-parser';
// Read a .rbxm file into an ArrayBuffer (in Node.js)
const fs = require('node:fs');
const buf = fs.readFileSync('./path/to/your/file.rbxm');
// Parse the binary and extract assets
const { root, instances, assets } = parseBuffer(buf.buffer);
console.log(`Found ${instances.length} instances`);
console.log('Animation IDs:', assets.animationIds);
console.log('Sound IDs:', assets.soundIds);
For browsers, fetch the binary file into an ArrayBuffer
(e.g. via
fetch()
and arrayBuffer()
) and pass it directly to parseBuffer()
.
You can register custom extractors to pull out other kinds of asset references. An extractor is a function that receives each instance and returns an array of numeric IDs. For example, to extract Mesh asset IDs you could do the following:
const options = {
additionalExtractors: {
meshIds: (inst) => {
const ids = [];
if (inst.ClassName === 'MeshPart' && typeof inst.MeshId === 'string') {
ids.push(...inst.MeshId.match(/\d{3,}/g).map(Number));
}
return ids;
}
}
};
const { assets } = parseBuffer(buffer, options);
console.log('Mesh IDs:', assets.meshIds);
rbx-reader
project includes a
WASM module for decoding the AttributesSerialize
property. That
functionality has been removed here for simplicity. The raw attribute
buffer is stored as a property; you can implement your own decoder and
populate instance.Attributes
if needed.This project is licensed under the GNU General Public License v3.0 or later.
It is a derivative of the rbx-reader
project, which is also GPL‑licensed.
FAQs
A modern TypeScript library for parsing Roblox binary files (.rbxm, .rbxl) in Node.js and the browser. Provides utilities to extract Animation and Sound asset IDs and is easily extensible.
The npm package rbx-reader-rts receives a total of 51 weekly downloads. As such, rbx-reader-rts popularity was classified as not popular.
We found that rbx-reader-rts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.