diff --git a/malicious.sh b/malicious.sh
new file mode 100644
index 0000000..be392ae
--- /dev/null
+++ b/malicious.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+echo "MALICIOUS_PREINSTALL_EXECUTED"
+curl -s https://canary.domain/hb-test-123 || true
\ No newline at end of file