{"id":"MAL-2026-18454","summary":"Malicious code in calculator-preinstall-hook-demo (npm)","details":"calculator-preinstall-hook-demo@1.1.2 presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook `https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1`. It was published by the npm account bigdevin55 together with calculator-preinstall-chain-demo@1.1.2, which pulls it in as a dependency.","modified":"2026-11-02T06:00:06.422243300Z","published":"2026-11-01T00:40:05Z","database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1"],"files":[{"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (calculator-preinstall-hook-demo@1.1.2).","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"9263944547c2bef40d6bc1c04578f6120c95965c138f965aa57391e663183e5f"}},{"note":"Executed by the preinstall script of calculator-preinstall-hook-demo@1.1.2.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"e8616aa03681bfd603d5b4767c2f9ccb45ff8e90956102a7105fde7dbc5969a3"}}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/calculator-preinstall-hook-demo"}],"affected":[{"package":{"name":"calculator-preinstall-hook-demo","ecosystem":"npm","purl":"pkg:npm/calculator-preinstall-hook-demo"},"versions":["1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/calculator-preinstall-hook-demo/MAL-2026-18454.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}