{"id":"MAL-2026-18453","summary":"Malicious code in calculator-preinstall-chain-demo (npm)","details":"calculator-preinstall-chain-demo@1.1.2 has no install script of its own but depends on exactly calculator-preinstall-hook-demo@1.1.2, so npm install runs that package's preinstall script (`node preinstall.js`). The script POSTs the machine's hostname and the OS username to the Discord webhook `https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1`. Both packages were published by the npm account bigdevin55 on 2026-11-01.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (88c07c18a13b451e734355c6d2bb4ca05dc4c76209fe483b97403c968c09c0ea)\nThe OpenSSF Package Analysis project identified 'calculator-preinstall-chain-demo' @ 1.1.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-11-02T06:30:05.228675616Z","published":"2026-11-01T00:39:35Z","database_specific":{"iocs":{"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"bb605d4d0ff114fe127e7ecd8473d78ae49730d4b2b627d3cb0496c9fdd1f2e6"},"note":"depends on calculator-preinstall-hook-demo 1.1.2, whose preinstall POSTs hostname and username to a Discord webhook (calculator-preinstall-chain-demo@1.1.2).","paths":["package.json"]}],"urls":["https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1"]},"malicious-packages-origins":[{"modified_time":"2026-11-01T01:08:06Z","sha256":"88c07c18a13b451e734355c6d2bb4ca05dc4c76209fe483b97403c968c09c0ea","source":"ossf-package-analysis","versions":["1.1.1"],"import_time":"2026-11-02T06:26:01.369649878Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/calculator-preinstall-chain-demo"}],"affected":[{"package":{"name":"calculator-preinstall-chain-demo","ecosystem":"npm","purl":"pkg:npm/calculator-preinstall-chain-demo"},"versions":["1.1.2","1.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/calculator-preinstall-chain-demo/MAL-2026-18453.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}