Malicious Code Detected in node-calculator-cf8c: A Critical Security Threat
Summary
MAL-2025-190578: Malicious code in node-calculator-cf8c (npm). Affects node-calculator-cf8c versions 2.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-calculator-cf8c is an npm package designed for performing basic arithmetic calculations. It is intended to provide users with a simple interface for mathematical operations. However, the package has been flagged for malicious behavior, specifically in version 2.1.2, which compromises the security of applications that utilize it.
Vulnerability Detail
The vulnerability in node-calculator-cf8c arises from its ability to communicate with a domain linked to malicious activities. This behavior indicates that the package may execute harmful commands, potentially leading to unauthorized access, data breaches, or system compromise. The origin of this vulnerability has been traced back to the package's design, which allows it to perform actions that can be exploited by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-cf8cIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the node-calculator-cf8c package altogether and implement basic arithmetic functions directly in your code. For example:
function add(a, b) {
return a + b;
}
function subtract(a, b) {
return a - b;
}
function multiply(a, b) {
return a * b;
}
function divide(a, b) {
if (b === 0) throw new Error('Cannot divide by zero');
return a / b;
}
Conclusion
The node-calculator-cf8c package poses a significant security risk due to its malicious behavior. Users are strongly encouraged to remove the package and implement safer alternatives to protect their applications from potential threats.
See every vulnerability recorded for node-calculator-cf8c →
FAQ
node-calculator-cf8c is an npm package used for performing basic arithmetic calculations.
The package has been flagged for communicating with a domain associated with malicious activities and executing harmful commands.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
It is advised to remove the package and update to a secure alternative or implement basic arithmetic functions directly in your code.
As of now, there is no patched version available for node-calculator-cf8c, so it is best to remove it and find a trusted alternative.
