{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "calculator-preinstall-hook-demo"
   },
   "versions": [
    "1.1.1"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/calculator-preinstall-hook-demo/1.1.1"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "calculator-preinstall-hook-demo 1.1.1 runs node preinstall.js as a preinstall script. The script sends an HTTPS POST to a Discord webhook (https://discord.com/api/webhooks/1566215853794394162/<token>) with the fixed text 'pitest: npm preinstall test notification.', which tells the webhook owner that the package was installed and from which network address, then writes a .preinstall-marker.json file into the package directory. Version 1.1.2 extends the same message with the hostname and user name. Remove the package and block the webhook on build hosts.",
 "id": "PROTET-NPM-2026-140",
 "modified": "2026-11-01T08:29:02Z",
 "published": "2026-11-01T08:29:02Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/calculator-preinstall-hook-demo/1.1.1"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Install script contacts a Discord webhook, notifying a third party of each install and the installing network address"
}