Protet Intel / npm / calculator-preinstall-hook-demo
calculator-preinstall-hook-demo 1.1.1
Every version of this package that Protet Intel names: Is calculator-preinstall-hook-demo malicious?
Summary
Install script contacts a Discord webhook, notifying a third party of each install and the installing network address
Details
calculator-preinstall-hook-demo 1.1.1 runs node preinstall.js as a preinstall script. The script sends an HTTPS POST to a Discord webhook (https://discord.com/api/webhooks/1566215853794394162/<token>) with the fixed text 'pitest: npm preinstall test notification.', which tells the webhook owner that the package was installed and from which network address, then writes a .preinstall-marker.json file into the package directory. Version 1.1.2 extends the same message with the hostname and user name. Remove the package and block the webhook on build hosts.
Indicators
URLshttps://discord.com/api/webhooks/1566215853794394162/
Records
- OSV record PROTET-NPM-2026-140
- Feeds: NDJSON, Atom
Status history
- 2026-11-01: named as a Protet finding