Malicious Code Detected in node-calculator-fahw: A Security Alert
Summary
MAL-2025-6739: Malicious code in node-calculator-fahw (npm). Affects node-calculator-fahw versions >= 2.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-calculator-fahw package is an npm library designed for performing various mathematical calculations. It is widely used in applications that require arithmetic functionalities. However, this package has been identified as having a vulnerability that allows it to communicate with a domain associated with malicious activities, posing a risk to users and their data.
Vulnerability Detail
The vulnerability originates from version 2.2.0 of the node-calculator-fahw package, which has been found to establish connections with a domain linked to malicious actions. This could lead to data breaches, unauthorized access, or other security incidents, as the package may transmit sensitive information to the malicious domain. Users of this package should be aware of the potential risks associated with its use.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-calculator-fahwIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the node-calculator-fahw package from your project until a secure version is confirmed. You can uninstall it using the following command: npm uninstall node-calculator-fahw.
Conclusion
The node-calculator-fahw package has a critical vulnerability that allows it to connect to a malicious domain. Users should take immediate action to update or remove the package to protect their applications from potential threats. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for node-calculator-fahw →
FAQ
node-calculator-fahw is an npm package used for performing mathematical calculations in JavaScript applications.
The package has been found to communicate with a domain that is linked to malicious activities, which could compromise user data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Yes, users are advised to update to the latest version of the node-calculator-fahw package to mitigate the vulnerability.
As a temporary measure, consider uninstalling the package until a secure version is available.
