correct-calc (npm): malicious package fully compromises machines that install it; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published a malware advisory (GHSA-fvf5-h3m3-g793) for the npm package correct-calc, flagged as embedded malicious code (CWE-506). Every published version (= 0) is affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside actor; removing the package does not guarantee removal of all malicious software. Reach appears limited (~19 downloads/month), but any installation is treated as a compromise. Remediation requires removing the package and rotating all secrets and keys from a clean machine.
What to do
- Treat any machine with correct-calc installed as fully compromised; rebuild from a clean image
- Rotate all secrets, keys, and credentials stored on affected machines, from a different computer
- Remove the package and audit for persistence and follow-on malware
- Audit dependency trees and CI systems for correct-calc and block/flag it in package registries and proxies
Sources
All live incidents on Threat Watch
