{"id":"MAL-2026-18454","kind":"package","aliases":["MAL-2026-18454"],"related":[],"title":"Malicious code in calculator-preinstall-hook-demo (npm)","description":"calculator-preinstall-hook-demo@1.1.2 presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook `https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1`. It was published by the npm account bigdevin55 together with calculator-preinstall-chain-demo@1.1.2, which pulls it in as a dependency.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"calculator-preinstall-hook-demo","fixed":[],"affected":"= 1.1.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T00:40:05+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","triaged_at":"2026-11-02T06:53:12+00:00","updated_at":"2026-11-02T06:53:35+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18454':12A,15A '-2026':11A,14A '/api/webhooks/1566215853794394162/xsqpebsn-cc3du2akwdzqwnxx5hjtfv-guepqz4evrhglzctmd40tkcrn42qnjd7moc1':64C '1.1.2':28C,80C 'account':71C 'bigdevin55':72C 'calcul':5A,24C,76C 'calculator':17A 'calculator-preinstall-chain-demo':75C 'calculator-preinstall-hook-demo':4A,16A,23C 'chain':78C 'code':2A 'demo':8A,20A,27C,79C 'depend':87C 'discord':60C 'discord.com':63C 'discord.com/api/webhooks/1566215853794394162/xsqpebsn-cc3du2akwdzqwnxx5hjtfv-guepqz4evrhglzctmd40tkcrn42qnjd7moc1':62C 'fixtur':34C 'hook':7A,19A,26C,38C 'hostnam':53C 'instal':47C 'lifecycl':37C 'machin':51C 'mal':10A,13A 'malici':1A,21B 'node':43C 'npm':9A,36C,46C,70C 'os':56C 'packag':22B 'post':49C 'preinstal':6A,25C,40C,77C 'preinstall':18A 'preinstall.js':44C 'present':29C 'publish':67C 'pull':82C 'run':42C 'script':41C 'test':33C 'togeth':73C 'usernam':57C 'webhook':61C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["calculatorpreinstallhookdemo"],"ptokens":["calculator","demo","hook","preinstall"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-01T00:40:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18454","url":"https://osv.dev/vulnerability/MAL-2026-18454","severity":"critical","published_at":"2026-11-01T00:40:05+00:00","modified_at":"2026-11-02T06:00:06+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","fetched_at":"2026-11-02T06:51:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}