Executive brief
A counterfeit npm package named mogodb-core (typosquatting the legitimate MongoDB library) contained malicious code that collected and transmitted system information (OS type, hostname) to an attacker-controlled server. Any developer or application using this package would automatically exfiltrate sensitive system metadata, creating a foothold for further compromise.
Technical details
This is a supply-chain attack via a malicious npm package (CWE-506: Embedded Malicious Code). The attack exploits typosquatting—the package name mogodb-core closely resembles the legitimate MongoDB driver—to trick developers into installation. The malicious code runs at install time or application startup with no authentication required; it silently gathers and uploads OS and hostname information to a remote server. This provides reconnaissance data and proves code execution, enabling follow-on attacks. The vulnerability affects all versions of the affected package; removal and legitimate MongoDB driver installation are required for remediation.
Affected products
- npm mogodb-core all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory: GitHub reviewed