Malicious Code Detected in node-calculator-8ddb Package - Security Alert
Summary
MAL-2025-190524: Malicious code in node-calculator-8ddb (npm). Affects node-calculator-8ddb versions 3.0.13. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The node-calculator-8ddb package is a JavaScript library available on npm, designed for performing basic arithmetic calculations. It is commonly used in web applications that require simple mathematical operations. However, this package has been identified as containing malicious code, which poses a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the node-calculator-8ddb package, specifically version 3.0.13. This code is designed to communicate with a domain associated with malicious activity, potentially leading to data breaches, unauthorized access, or other harmful consequences for users and systems relying on this package. The identification of this vulnerability was confirmed by both Amazon Inspector and the OpenSSF Package Analysis project.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-8ddbIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, consider replacing the node-calculator-8ddb package with a trusted alternative that provides similar functionality without the associated risks. Ensure to review the package's reputation and security history before integrating it into your project.
Conclusion
The node-calculator-8ddb package has been flagged for containing malicious code, posing a significant risk to applications that utilize it. Users are advised to uninstall the package and seek safer alternatives to protect their systems from potential threats.
See every vulnerability recorded for node-calculator-8ddb →
FAQ
node-calculator-8ddb is a JavaScript library used for performing basic arithmetic calculations in web applications.
The malicious code was identified by security analysis tools, including Amazon Inspector and the OpenSSF Package Analysis project.
Using the compromised package can lead to data breaches, unauthorized access, and other security vulnerabilities in your application.
Currently, there is no patched version of the node-calculator-8ddb package. It is recommended to uninstall it and seek alternatives.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
