npm
Malicious @spreadjs/js-calc @99.9.1
Vulnerability report · Last retrieved from osv.dev July 9, 2026 at 12:27 PM UTC
OSV ID
MAL-2026-2596
Ecosystem
npm
Summary
The package @spreadjs/js-calc was found to contain malicious code.
Source: amazon-inspector (c7909a65c6a2c928f12a2333a6e1c53c7dea90685fe7b2be35f120654a6f86d7)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.