Malicious Code Detected in node-calculator-9b93: A Critical Security Alert
Summary
MAL-2025-190536: Malicious code in node-calculator-9b93 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-calculator-9b93 package is an npm library designed for performing basic arithmetic calculations. It is often utilized in JavaScript applications to simplify mathematical operations. However, this package has been identified as containing malicious code, posing significant security risks to applications that depend on it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the node-calculator-9b93 package. This code can potentially execute harmful actions on the host system, such as data theft or unauthorized access to sensitive information. The malicious nature of this code was identified by Amazon Inspector, which flagged the package for its security risks. Users of this package are at risk of exploitation if they do not take immediate action to mitigate the threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-9b93If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the node-calculator-9b93 package altogether and implement basic arithmetic functions directly in your code. For example, you can create a simple calculator function as follows:
function add(a, b) { return a + b; }
function subtract(a, b) { return a - b; }
function multiply(a, b) { return a * b; }
function divide(a, b) { return a / b; }
Conclusion
The discovery of malicious code in the node-calculator-9b93 package highlights the importance of regularly monitoring and updating dependencies in software projects. Users must take proactive steps to secure their applications by removing affected packages and utilizing alternatives or workarounds.
See every vulnerability recorded for node-calculator-9b93 →
FAQ
It is an npm library used for performing arithmetic calculations in JavaScript applications.
The malicious code was identified by Amazon Inspector, a security tool that scans for vulnerabilities in software packages.
Using the compromised package can lead to data breaches, unauthorized access, and other security vulnerabilities in your application.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can alert you to any vulnerabilities in real-time.
If immediate updates are not possible, consider implementing a workaround by using custom arithmetic functions in your code.
