Malicious Code Detected in node-calculator-522f Package - Security Alert
Summary
MAL-2025-190531: Malicious code in node-calculator-522f (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-calculator-522f package is a JavaScript library available through npm that provides basic arithmetic operations. It is designed for developers looking to integrate simple calculation functionalities into their applications. However, this package has been flagged for containing malicious code, which poses significant security risks to any application utilizing it.
Vulnerability Detail
The vulnerability originates from the presence of malicious code within the node-calculator-522f package. This code can potentially execute harmful actions, such as data theft or unauthorized access to system resources. The malicious nature of this package was identified by Amazon Inspector, which detected the issue based on its analysis of the package's codebase. The implications of using this compromised package can lead to severe security breaches, data loss, and compromised application integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-522fIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the node-calculator-522f package altogether and implement basic arithmetic functions directly in your code. For example:
function add(a, b) {
return a + b;
}
function subtract(a, b) {
return a - b;
}
function multiply(a, b) {
return a * b;
}
function divide(a, b) {
if (b === 0) throw new Error('Cannot divide by zero');
return a / b;
}
Conclusion
The node-calculator-522f package has been identified as containing malicious code, posing a serious security threat to applications that utilize it. It is essential to uninstall this package and replace it with a secure alternative to protect your application and its users.
See every vulnerability recorded for node-calculator-522f →
FAQ
The node-calculator-522f package is a JavaScript library that provides basic arithmetic operations for developers.
The malicious code was detected by Amazon Inspector, which analyzed the package and identified harmful elements within its code.
Using the node-calculator-522f package can lead to security breaches, data theft, and unauthorized access to your application and its users.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you have already used the node-calculator-522f package, you should uninstall it immediately and replace it with a secure alternative.
