calculator-preinstall-chain-demo@1.1.2
Test fixture: depends on NPM1 to demonstrate a transitive preinstall hook
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe transitive dependency executes automatically during installation and sends host and user identifying data to a hard-coded Discord webhook. This is install-time data exfiltration unrelated to the calculator package's purpose.
Static reason
No blocking static signals were detected.
Trigger
Installing this package installs its dependency, whose preinstall script runs automatically.
Impact
The installation discloses the machine hostname and OS username to the webhook recipient.
Mechanism
The hook POSTs the machine hostname and OS username to a hard-coded Discord webhook URL.
Attack narrative
During installation, the package's dependency runs a preinstall hook that sends the machine hostname and OS username to a hard-coded Discord webhook. The hook also writes a local marker file.
AI rationale
The transitive dependency executes automatically during installation and sends host and user identifying data to a hard-coded Discord webhook. This is install-time data exfiltration unrelated to the calculator package's purpose.
Evidence
package.json.lpm-dependency-evidence-7b044aea-4dbb-4b09-bafa-9ded2a0ef7b5/0/npm-linux/package.json.lpm-dependency-evidence-7b044aea-4dbb-4b09-bafa-9ded2a0ef7b5/0/npm-linux/preinstall.js.lpm-dependency-evidence-7b044aea-4dbb-4b09-bafa-9ded2a0ef7b5/0/npm-linux/.preinstall-marker.json
Network endpoints1
discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The parent package depends on calculator-preinstall-hook-demo@1.1.2.
- That dependency runs node preinstall.js through its preinstall script during installation.
- The hook posts to a hard-coded Discord webhook.
- The POST body includes the machine hostname and OS username.
Evidence against
- The parent package has no lifecycle scripts of its own.
Behavioral surface
Trivial
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•dependencies.calculator-preinstall-hook-demo = 1.1.2
previous = 1.1.1
independentlyConfirmedMalicious = calculator-preinstall-hook-demo@1.1.2 (lpm_ai_confirmed)
Critical
Known Malicious Dependency Insertion
A newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.
package.jsonView on unpkg7"dependencies": {
"calculator-preinstall-hook-demo": "1.1.2"
},
"li
High
Ai Review Evidence
The parent package depends on calculator-preinstall-hook-demo@1.1.2.
package.jsonView on unpkg · L7.lpm-dependency-evidence-7b044aea-4dbb-4b09-bafa-9ded2a0ef7b5/0/npm-linux/package.jsonView file
8"scripts": {
"preinstall": "node preinstall.js"
},
"license": "UN
Findings
1 Critical4 High1 Low
CriticalKnown Malicious Dependency Insertionpackage.json
HighAi Review Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-7b044aea-4dbb-4b09-bafa-9ded2a0ef7b5/0/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-7b044aea-4dbb-4b09-bafa-9ded2a0ef7b5/0/npm-linux/preinstall.js
HighAi Review Evidence.lpm-dependency-evidence-7b044aea-4dbb-4b09-bafa-9ded2a0ef7b5/0/npm-linux/preinstall.js
LowNo License
Affected versions and remediation
This report applies to calculator-preinstall-chain-demo@1.1.2.
See all versions of calculator-preinstall-chain-demo for other recorded verdicts.
- Avoid installing calculator-preinstall-chain-demo@1.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.