Which versions of node-calculator-f483 are malicious?

The following npm versions of node-calculator-f483 are flagged malicious: 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.7.0. Treat any of these as compromised.

How do I remediate node-calculator-f483 if I installed it?

Remove node-calculator-f483 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed node-calculator-f483 — how do I know if it already compromised me?

If node-calculator-f483 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is node-calculator-f483 part of a known attack campaign?

Yes — node-calculator-f483 is associated with the RLMA-2025-06430 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find node-calculator-f483 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for node-calculator-f483 (5 malicious versions).

Malicious package

node-calculator-f483npm

Advisory published Dec 23, 2025Updated Jan 2, 2026

node-calculator-f483 is a confirmed malicious npm package (MAL-2025-192844) that executes malicious code on install (malicious versions 3.3.0, 3.4.0, 3.5.0…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in node-calculator-f483 (npm)

MAL-2025-192844

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall node-calculator-f483

What this malware does

The package node-calculator-f483 was found to contain malicious code.

Malicious versions

5 flagged

3.3.03.4.03.5.03.6.03.7.0

Indicators of compromise (SHA-256)

90780d4bb601eb88f1a3a9b4fc4a881bab907272d2c687f61978a6e3358ddfad

84a5e8d3f7bc17fcc1c20611e0b98235c4015291f1fe1af1f31497d604654663

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for node-calculator-f483 (5 malicious versions).
If you installed it — respond
Remove node-calculator-f483 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If node-calculator-f483 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. node-calculator-f483 on npm has been identified as a malicious package (versions 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.7.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-06430

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks node-calculator-f483-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database