openllmapi@4.0.2

Analysis

Package openllmapi@4.0.2 is a trojanized impersonation of an LLM API client. During npm install, its preinstall hook executes mshta.exe with a remote URL (hxxp://fixars[.]top), causing Windows systems to silently download and execute an arbitrary HTA payload from that domain. The main source file is a decoy boilerplate API client; the malicious behaviour is in the preinstall script only.