Malicious Code Detected in node-calculator-1b6e: A Security Threat
Summary
MAL-2025-190517: Malicious code in node-calculator-1b6e (npm). Affects node-calculator-1b6e versions 3.0.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-calculator-1b6e is an npm package designed for performing basic arithmetic calculations. It is widely used in various JavaScript applications due to its simplicity and ease of integration. However, recent findings have revealed that this package contains malicious code that compromises user security.
Vulnerability Detail
The vulnerability in node-calculator-1b6e originates from its version 3.0.11, which has been flagged for communicating with a domain associated with malicious activities. This poses significant risks, including data theft, unauthorized access to user systems, and potential exploitation of other vulnerabilities within the application. The malicious code can execute harmful operations without the user's consent, making it imperative for users to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-1b6eIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the node-calculator-1b6e package from their project until a secure version is released. This can be done with the command: npm uninstall node-calculator-1b6e. Alternatively, consider using a different package that offers similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the node-calculator-1b6e package highlights the importance of regularly monitoring and updating dependencies in software projects. Users are urged to take immediate action by updating or removing the affected package to safeguard their applications from potential threats.
See every vulnerability recorded for node-calculator-1b6e →
FAQ
The malicious code enables the package to communicate with a domain linked to harmful activities, potentially compromising user data and system integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
If immediate updates are not feasible, consider removing the package from your project or using an alternative package until a secure version is available.
Utilize tools like Vulert, which can monitor your package-lock.json file for vulnerabilities and provide real-time alerts.
Uninstalling the package should not result in data loss, but ensure that you have backups of your project and any critical data before making changes.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
