calculator-preinstall-hook-demo@1.1.1
Private test fixture: sends a fixed webhook notification during preinstall
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest runs a hook that automatically contacts a hard-coded Discord webhook without installer consent. The payload is a fixed notification rather than sensitive data, so this is install-hook abuse rather than data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm installation runs the preinstall lifecycle script.
Impact
The webhook operator can observe installation-triggered contact without the installer's consent; the inspected request does not include host, user, project, or credential data.
Mechanism
preinstall.js POSTs a fixed test notification to the embedded webhook, then records the outcome locally.
Attack narrative
During installation, the preinstall hook sends a fixed test notification to a hard-coded Discord webhook without installer consent. The request does not contain credentials or machine or project details, but it creates unsolicited contact with an external collector.
AI rationale
The manifest runs a hook that automatically contacts a hard-coded Discord webhook without installer consent. The payload is a fixed notification rather than sensitive data, so this is install-hook abuse rather than data exfiltration.
Evidence
package.jsonpreinstall.js.preinstall-marker.json
Network endpoints1
discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs preinstall.js automatically during installation.
- preinstall.js contains a fixed Discord webhook URL.
- The hook POSTs a fixed notification to that webhook without requiring installer consent.
- The hook writes a local .preinstall-marker.json file with the notification result.
Evidence against
- The POST body contains a fixed test message, not environment variables, credentials, or project data.
- The README describes this as a private test fixture and says it should not be published or distributed with its embedded webhook.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node preinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node preinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpreinstall.jsView file
5L6: const WEBHOOK_URL = 'https://discord.[redacted]-cc3DU2AKWdzqWnXX5hjTfV-[redacted]';
L7:
...
L10: writeMarker = marker => fs.writeFileSync(
L11: path.join(__dirname, '.preinstall-marker.json'),
L12: JSON.stringify(marker, null, 2) + '\n'
...
L17: package: 'calculator-preinstall-hook-demo',
L18: event: process.env.npm[redacted] || 'manual',
L19: timestamp: new Date().toISOString(),
...
L25: headers: { 'Content-Type': 'application/json' },
L26: body: JSON.stringify({
L27: content: 'pitest: npm preinstall test notification.',
Findings
4 Critical3 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationpreinstall.js
CriticalCredential Exfiltrationpreinstall.js
CriticalTrigger Reachable Dangerous Capabilitypreinstall.js
CriticalPrevious Version Dangerous Deltapreinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighFixed Authenticated Webhook Data Exfiltrationpreinstall.js
HighTrigger Reachable Credential Exfiltrationpreinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to calculator-preinstall-hook-demo@1.1.1.
See all versions of calculator-preinstall-hook-demo for other recorded verdicts.
- Avoid installing calculator-preinstall-hook-demo@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.