Is calculator-preinstall-hook-demo malicious?
Yes. Protet confirmed 2 versions of calculator-preinstall-hook-demo as malicious
First confirmed on 2026-11-01.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 1.1.1 | 2026-11-01 | PROTET-NPM-2026-140 |
| 1.1.2 | 2026-11-01 | PROTET-NPM-2026-139 |
What it does
Install script contacts a Discord webhook, notifying a third party of each install and the installing network address
calculator-preinstall-hook-demo 1.1.1 runs node preinstall.js as a preinstall script. The script sends an HTTPS POST to a Discord webhook (https://discord.com/api/webhooks/1566215853794394162/<token>) with the fixed text 'pitest: npm preinstall test notification.', which tells the webhook owner that the package was installed and from which network address, then writes a .preinstall-marker.json file into the package directory. Version 1.1.2 extends the same message with the hostname and user name. Remove the package and block the webhook on build hosts.
Indicators
URLshttps://discord.com/api/webhooks/1566215853794394162/
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-11-01: 1.1.2, 1.1.1 named by Protet Intel