The gptmini npm package versions 4.0.2 and 4.0.6 contain malicious code that executes during installation on Windows systems. Specifically, the package's preinstall script runs a command that downloads and executes an HTML Application from a remote attacker-controlled HTTP server, resulting in remote code execution without user interaction. The package masquerades as a GPT/OpenAI SDK wrapper but has empty author metadata and connects to an unrelated domain, indicating malicious intent.