{"id":"MAL-2026-18453","kind":"package","aliases":["MAL-2026-18453"],"related":[],"title":"Malicious code in calculator-preinstall-chain-demo (npm)","description":"calculator-preinstall-chain-demo@1.1.2 has no install script of its own but depends on exactly calculator-preinstall-hook-demo@1.1.2, so npm install runs that package's preinstall script (`node preinstall.js`). The script POSTs the machine's hostname and the OS username to the Discord webhook `https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1`. Both packages were published by the npm account bigdevin55 on 2026-11-01.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (88c07c18a13b451e734355c6d2bb4ca05dc4c76209fe483b97403c968c09c0ea)\nThe OpenSSF Package Analysis project identified 'calculator-preinstall-chain-demo' @ 1.1.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"calculator-preinstall-chain-demo","fixed":[],"affected":"= 1.1.2","ecosystem":"npm"},{"name":"calculator-preinstall-chain-demo","fixed":[],"affected":"= 1.1.2; = 1.1.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T00:39:35+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","triaged_at":"2026-11-02T06:53:12+00:00","updated_at":"2026-11-02T07:21:41+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':92C '-11':91C '-18453':12A,15A '-2026':11A,14A '/api/webhooks/1566215853794394162/xsqpebsn-cc3du2akwdzqwnxx5hjtfv-guepqz4evrhglzctmd40tkcrn42qnjd7moc1':79C '1.1.1':119C '1.1.2':33C,50C '2026':90C '88c07c18a13b451e734355c6d2bb4ca05dc4c76209fe483b97403c968c09c0ea':107C 'account':87C 'activ':137C 'analysi':106C,111C 'associ':134C 'bigdevin55':88C 'calcul':5A,29C,46C,115C 'calculator':17A,22A 'calculator-preinstall-chain-demo':4A,16A,21A,28C,114C 'calculator-preinstall-hook-demo':45C 'chain':7A,19A,24A,31C,117C 'code':2A 'communic':130C 'consid':125C 'demo':8A,20A,25A,32C,49C,118C 'depend':42C 'detail':95C 'discord':75C 'discord.com':78C 'discord.com/api/webhooks/1566215853794394162/xsqpebsn-cc3du2akwdzqwnxx5hjtfv-guepqz4evrhglzctmd40tkcrn42qnjd7moc1':77C 'domain':133C 'edit':98C 'exact':44C 'hook':48C 'hostnam':68C 'identifi':113C 'instal':36C,53C 'line':101C 'machin':66C 'mal':10A,13A 'malici':1A,26B,122C,126C,136C 'node':60C 'npm':9A,52C,86C,120C 'openssf':109C 'os':71C 'ossf':104C 'ossf-package-analysi':103C 'packag':27B,56C,81C,105C,110C,129C 'per':93C 'post':64C 'preinstal':6A,30C,47C,58C,116C 'preinstall':18A,23A 'preinstall.js':61C 'project':112C 'publish':83C 'run':54C 'script':37C,59C,63C 'sourc':94C,102C 'usernam':72C 'webhook':76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["calculatorpreinstallchaindemo"],"ptokens":["calculator","chain","demo","preinstall"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-01T00:39:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18453","url":"https://osv.dev/vulnerability/MAL-2026-18453","severity":"critical","published_at":"2026-11-01T00:39:35+00:00","modified_at":"2026-11-02T06:30:05+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}