The minigptcore package version 4.0.8 includes a preinstall script (preinstall.js) that executes a Windows command to run mshta.exe, fetching an HTA script from a hardcoded external URL over unencrypted HTTP. The fetched script is unpinned and unverified, unrelated to the package's intended functionality, and executes with the user's privileges during npm install. The package.json contains placeholder metadata consistent with a malicious dropper rather than a legitimate package. This constitutes a remote code execution threat via supply chain compromise in the npm ecosystem.

Successful installation of this package version results in arbitrary code execution on the affected Windows system with the privileges of the installing user. This can lead to system compromise, data theft, or further malware deployment. The malicious payload is delivered via an untrusted external source over HTTP, increasing the risk of interception or modification.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing minigptcore version 4.0.8. Verify package authenticity before installation and prefer packages from trusted sources. Monitor npm repositories for updates or removals of this package. Since this is a malicious package upload, removal from the npm registry by maintainers or npm security teams is expected. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.