calculator-preinstall-hook-demo

GHSA-p373-68vj-fvrh

Malicious code in calculator-preinstall-hook-demo (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.2`

[email protected] presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook `https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1`. It was published by the npm account bigdevin55 together with [email protected], which pulls it in as a dependency.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5a3735a9d2ea3c7c6a95e61ffedf5ba2aefddfc0/osv/malicious/npm/calculator-preinstall-hook-demo/MAL-2026-18454.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5a3735a9d2ea3c7c6a95e61ffedf5ba2aefddfc0/osv/malicious/npm/calculator-preinstall-hook-demo/MAL-2026-18454.json
- https://www.npmjs.com/package/calculator-preinstall-hook-demo
- https://github.com/advisories/GHSA-p373-68vj-fvrh

Compromised versions (1)

= 1.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.