Critical Malicious Code Vulnerability in node-calculator-0f50 Package
Summary
MAL-2025-190516: Malicious code in node-calculator-0f50 (npm). Affects node-calculator-0f50 versions 10.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-calculator-0f50 package is an npm library designed for performing basic arithmetic calculations. It is intended for use in JavaScript applications where simple mathematical operations are required. However, this package has been identified as containing malicious code that compromises the security of systems using it.
Vulnerability Detail
The vulnerability in the node-calculator-0f50 package stems from the presence of embedded malicious code. This code communicates with a domain linked to malicious activities and executes commands that can lead to unauthorized access and control over the affected systems. The implications of this vulnerability are severe, as any system running this package is considered fully compromised, necessitating immediate action to secure sensitive data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-0f50If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if you need similar functionality, consider using alternative packages that provide arithmetic operations without the associated risks. Always verify the security of third-party packages before installation.
Conclusion
The node-calculator-0f50 package has been identified as containing malicious code that poses significant security risks. Immediate removal of the package is necessary to protect your systems and data. Always ensure to use secure and trusted packages in your projects.
See every vulnerability recorded for node-calculator-0f50 →
FAQ
It is an npm package designed for performing basic arithmetic calculations in JavaScript applications.
The malicious code can compromise your system by communicating with harmful domains and executing unauthorized commands.
You should immediately uninstall the node-calculator-0f50 package and rotate any secrets or keys stored on the affected system.
Yes, consider using other reputable npm packages for arithmetic operations, ensuring they are free from known vulnerabilities.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time without requiring code access.
