aillmgen@4.0.2

Analysis

On installation, this package runs a preinstall hook that shells out to the Windows mshta utility against a remote URL (fixars[.]top). mshta downloads and executes arbitrary HTA/script content served by that host, giving the operator install-time remote code execution on the victim machine with no user interaction. The packages main module presents a generic LLM-client API as a cover; the actual payload is the automatically-executed install script.