Malicious npm package calculator-preinstall-hook-demo exfiltrates hostname and username via Discord webhook
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
GitHub Advisory Database (GHSA-p373-68vj-fvrh, credited to OpenSSF) flags calculator-preinstall-hook-demo@1.1.2 as malicious code. The package poses as a test fixture for npm lifecycle hooks, but its preinstall script runs node preinstall.js during npm install, POSTing the machine's hostname and OS username to a hardcoded Discord webhook. It was published by the npm account bigdevin55 alongside calculator-preinstall-chain-demo@1.1.2, which pulls it in as a dependency, so installing the chain package also triggers the exfiltration. Affected version is 1.1.2 of both packages; there are no patched versions, and the packages should be treated as malware and removed. Anyone who installed either package on or after publication may have leaked host and user details.
What to do
- Check lockfiles and installed node_modules for calculator-preinstall-hook-demo and calculator-preinstall-chain-demo; remove them and purge caches
- If installed, treat the build machine as exposed: rotate credentials available to the user account, review access logs, and consider rebuilding from a clean image
- Block the Discord webhook URL and monitor egress for connections to discord.com/api/webhooks from CI and developer machines
- Audit npm install logs to determine whether the preinstall script executed and when
- Pin dependencies and avoid installing unvetted packages, especially those with lifecycle scripts
Sources
All live incidents on Threat Watch
