Critical Malicious Code Vulnerability in node-calculator-36ae Package
Summary
MAL-2025-190551: Malicious code in node-calculator-36ae (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The node-calculator-36ae package is a JavaScript library available on npm, designed to perform basic arithmetic calculations. It is intended for developers looking to integrate simple calculator functionalities into their applications. However, this package has been identified as containing malicious code, which poses significant security risks to any system utilizing it.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the node-calculator-36ae package. This code can compromise the entire system where the package is installed, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications of this vulnerability are severe, as it can lead to complete system control by an external entity, making it imperative for users to act swiftly to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-36aeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks posed by this malicious package. The only recommended action is to uninstall the package and secure your system.
Conclusion
The discovery of malicious code in the node-calculator-36ae package highlights the importance of vigilance in managing open-source dependencies. Users must act quickly to remove the affected package and secure their systems to prevent potential exploitation.
See every vulnerability recorded for node-calculator-36ae →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on your system.
The malicious code can give an attacker complete control over your system, potentially leading to data breaches.
Yes, you can use Vulert to monitor and alert for vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
While many npm packages are safe, it is essential to review and monitor dependencies regularly for vulnerabilities.
Regularly update your dependencies, use tools like Vulert for monitoring, and review package sources before installation.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
