Executive brief
The mogoose npm package contained malicious code that exfiltrated system information including OS details and hostname to a remote server. Any project using this compromised package should immediately remove it and audit their systems for potential data exposure.
Technical details
This is a supply chain attack vector where a malicious npm package masquerading as "mogoose" (likely a typosquat of the legitimate "mongoose" MongoDB driver) was published to the npm registry. The package contains embedded malicious code that silently collects and exfiltrates sensitive host information (OS type, version, hostname) to an attacker-controlled remote server upon installation or execution. The attack requires no authentication or user interaction beyond the initial installation decision. This represents a critical supply chain compromise affecting any developer or CI/CD system that installed this package. The primary mitigation is immediate removal of the package and all transitive dependencies it may have introduced.
Affected products
- npm mogoose 0.0.0 and potentially all published versions
Timeline
- 2020-09-03: disclosed: Vulnerability published in GitHub Advisory Database
- 2020-08-31: advisory: GitHub reviewed and confirmed malicious content in npm package