Executive brief
mongose is a malicious npm package distributed via the Node.js package registry that steals sensitive environment variables (such as database credentials, API tokens, and registry access keys) and sends them to attacker-controlled servers. Installation of this malware can lead to immediate exposure of all stored credentials, enabling attackers to compromise databases, cloud services, and other systems accessible through those credentials.
Technical details
The mongose package is malicious code (CWE-506) embedded in a npm library that exfiltrates environment variables to external attacker-controlled locations. The attack vector is network-based with no authentication, privileges, or user interaction required—an infected package executes automatically upon installation or module load. The vulnerability affects all versions; the package has been unpublished from npm but may persist in project dependencies, cached installations, or private registries. Recovery requires removal of the package, cache clearing, credential rotation, and forensic review of any systems that may have been accessed using exposed credentials. No patch exists; the only mitigation is complete removal.
Affected products
- npm mongose all versions
Timeline
- 2018-10-10: disclosed
- other: CVE-2017-16077 assigned