CERT24MAL-2026-18453 — Malicious code in calculator-preinstall-chain-demo (npm)
OpenSSF Package Analysis identified calculator-preinstall-chain-demo version 1.1.1 on npm as malicious. According to the source, version 1.1.2 depends exactly on calculator-preinstall-hook-demo@1.1.2, whose preinstall script sends the machine hostname and operating-system username to a Discord webhook.