OpenSSF/OSV advisory MAL-2026-14016 confirms this npm version as malicious. package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an attacker-controlled exfiltration sink. The hook fires automatically on `npm install` before any user interaction, and webhook.site is not a first-party or documented destination for any legitimate build or runtime purpose of this package...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in preinstall-hook-webhook-callback-demo (npm)
Details
package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an attacker-controlled exfiltration sink. The hook fires automatically on `npm install` before any user interaction, and webhook.site is not a first-party or documented destination for any legitimate build or runtime purpose of this package. The combination of an auto-executing preinstall script wired to an out-of-band capture endpoint is the shape of installer-side data exfiltration / callback beaconing at install time.
Decision reason
OpenSSF Malicious Packages via OSV confirms preinstall-hook-webhook-callback-demo@1.0.0 as malicious (MAL-2026-14016): Malicious code in preinstall-hook-webhook-callback-demo (npm)