Critical Malicious Code Vulnerability in node-calculator-a34e Package
Summary
MAL-2025-192837: Malicious code in node-calculator-a34e (npm). Affects node-calculator-a34e versions 3.1.1 – 99999999999.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The node-calculator-a34e package is a JavaScript library available on npm that provides basic calculator functionalities. It is designed for developers looking to integrate simple arithmetic operations into their applications. However, this package has been identified as containing malicious code, which poses significant security risks to users who incorporate it into their projects.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the node-calculator-a34e package, which can lead to unauthorized access and manipulation of user data. This issue was reported by ReversingLabs and affects multiple versions of the package, including 3.1.1 and various other non-standard versions. The ramifications of this vulnerability can include data theft, system compromise, and potential exploitation of the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-a34eIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the node-calculator-a34e package from their project until a secure version is confirmed. This can be done using the command: npm uninstall node-calculator-a34e.
Conclusion
The node-calculator-a34e package contains a critical vulnerability due to malicious code that can compromise user data and system integrity. It is crucial for developers using this package to take immediate action by updating to a secure version or removing the package entirely until a fix is implemented.
See every vulnerability recorded for node-calculator-a34e →
FAQ
It is a JavaScript library that provides basic calculator functionalities for developers.
The malicious code can lead to unauthorized access and manipulation of user data, posing significant security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
You should update the package to the latest secure version or remove it from your project until a patch is available.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat intelligence.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
