The npm package 'react-editable-calendar' version 0.1.7 is identified as malicious. It declares a preinstall script pointing to a non-existent file, causing installation failure before any code execution. The package name and documented identity mismatch suggests possible intent to mislead developers. Although the published artifact does not contain exploitable code or network exfiltration capabilities, the package executes commands associated with malicious behavior. No known exploits are reported in the wild.