The gptcore npm package versions 4.0.6, 4.0.7, and 4.0.8 include a malicious preinstall script that executes a Windows command to launch mshta.exe and fetch code from an untrusted remote HTTP URL. This causes arbitrary HTA/JScript content from the remote host to run on the installer's machine during npm install. The remote content is unrelated to the package's documented purpose and is fetched without integrity verification or publisher trust.