Malicious Code Detected in node-calculator-e776: A Critical Vulnerability
Summary
MAL-2025-192842: Malicious code in node-calculator-e776 (npm). Affects node-calculator-e776 versions 4.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-calculator-e776 is an npm package designed for performing basic arithmetic calculations. It is utilized by developers to integrate simple calculator functionalities into their applications. However, this package has been identified as containing malicious code, which poses significant security risks to users and their applications.
Vulnerability Detail
The vulnerability in node-calculator-e776 stems from the inclusion of malicious code that can compromise the integrity of applications using this package. This code may allow unauthorized access to sensitive data, execute arbitrary commands, or lead to further exploitation of the system. The malicious nature of this package was reported by ReversingLabs, highlighting the importance of scrutinizing dependencies in software projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-e776If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you are unable to update the package immediately, consider removing the node-calculator-e776 package from your project and replacing it with a trusted alternative that provides similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the node-calculator-e776 package highlights the critical need for developers to regularly audit their dependencies. By updating to a secure version or replacing the package, users can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for node-calculator-e776 →
FAQ
node-calculator-e776 is an npm package used for basic arithmetic calculations in applications.
The malicious code can compromise application security, allowing unauthorized access and execution of arbitrary commands.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider removing the node-calculator-e776 package and replacing it with a trusted alternative until you can update.
The vulnerability was reported by ReversingLabs, a security research firm specializing in identifying malicious packages.
