{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "calculator-preinstall-hook-demo"
   },
   "versions": [
    "1.1.2"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/calculator-preinstall-hook-demo/1.1.2"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "calculator-preinstall-hook-demo 1.1.2 runs node preinstall.js as a preinstall script. The script sends an HTTPS POST to a Discord webhook (https://discord.com/api/webhooks/1566215853794394162/<token>) with the text 'pitest: npm preinstall test notification. Computer: <hostname>, User: <username>', then writes a .preinstall-marker.json file into the package directory. Version 1.1.1 posts to the same webhook without the host details. Remove the package and treat machines that installed it as having disclosed their hostname, user name and network address to a third party.",
 "id": "PROTET-NPM-2026-139",
 "modified": "2026-11-01T08:29:02Z",
 "published": "2026-11-01T08:29:02Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/calculator-preinstall-hook-demo/1.1.2"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Install script posts the hostname and user name of the installing machine to a Discord webhook"
}