Threat Intelligence Database

The npm package 'gptlite' version 4.0.8 contains malicious code in its preinstall lifecycle script. This script executes a Windows command that uses mshta.exe to fetch and run attacker-controlled code from an unauthenticated HTTP source (fixars.top) during installation. This results in arbitrary code execution on the installer's machine without user review.

APT-C-60 continues targeting organizations in Japan with evolved tactics observed throughout 2026. The threat group employs spear-phishing emails containing Proton Drive links or direct attachments with RAR archives. Victims extract LNK files that execute JavaScript via mshta.exe, leading to multi-stage payload delivery. The attackers abuse legitimate services including GitHub, GitLab, jsDelivr, and Codeberg as infrastructure for hosting malicious components. Git.exe is leveraged to execute scripts that deploy downloaders and loaders, ultimately delivering SpyGlace malware versions 3.1.15 through 3.1.18. The attack chain involves multiple obfuscated JavaScript files and persistence mechanisms similar to previous campaigns. By utilizing developer-oriented services and CDNs commonly allowed in corporate environments, the threat actor attempts to evade detection and blend malicious traffic with legitimate communications.

MediumMalwareJapan#japan#spyglace#living-off-the-land

The gptcore npm package versions 4.0.6, 4.0.7, and 4.0.8 include a malicious preinstall script that executes a Windows command to launch mshta.exe and fetch code from an untrusted remote HTTP URL. This causes arbitrary HTA/JScript content from the remote host to run on the installer's machine during npm install. The remote content is unrelated to the package's documented purpose and is fetched without integrity verification or publisher trust.

The minigptcore npm package version 4.0.8 contains malicious code that executes during installation. Its preinstall script runs a Windows command to invoke mshta.exe, which fetches and executes an unverified HTA script from an external HTTP domain. This behavior allows remote code execution with the privileges of the user running npm install. The package metadata is minimal and generic, indicating a likely throwaway malicious upload.

The TestPGAgent PyPI package versions 0.1 and 0.2 contain malicious code that executes during installation. The setup.py script uses base64-encoded obfuscated code to launch Windows mshta.exe to fetch and run a remote HTML application from an attacker-controlled HTTP server. This allows arbitrary code execution on any Windows machine installing these package versions. The malicious payload is unpinned, mutable, and unrelated to the declared publisher, indicating clear malicious intent.