# mogoose malicious package

Source: https://junglewise.ai/threats/mogoose-malicious-package-1f1e2ad2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2020-09-03

The mogoose npm package contained malicious code that exfiltrated system information including OS details and hostname to a remote server. Any project using this compromised package should immediately remove it and audit their systems for potential data exposure.

Technologies: [mongoose (npm)](https://junglewise.ai/threats/technologies/mongoose). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 3 September 2020.

**Which products and versions are affected?** mogoose (npm) SEMVER:introduced=0.0.0; mongoose (npm) 0.0.0 and potentially all published versions.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run mogoose (npm) or mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a supply chain attack vector where a malicious npm package masquerading as "mogoose" (likely a typosquat of the legitimate "mongoose" MongoDB driver) was published to the npm registry. The package contains embedded malicious code that silently collects and exfiltrates sensitive host information (OS type, version, hostname) to an attacker-controlled remote server upon installation or execution. The attack requires no authentication or user interaction beyond the initial installation decision. This represents a critical supply chain compromise affecting any developer or CI/CD system that installed this package. The primary mitigation is immediate removal of the package and all transitive dependencies it may have introduced.

## Affected products

- npm mogoose 0.0.0 and potentially all published versions

## Timeline

- 2020-09-03: disclosed: Vulnerability published in GitHub Advisory Database
- 2020-08-31: advisory: GitHub reviewed and confirmed malicious content in npm package

## References

- [https://www.npmjs.com/advisories/1135](https://www.npmjs.com/advisories/1135)

## Related threats

- [Mongoose sanitizeFilter not applied on countDocuments](https://junglewise.ai/threats/cve-2026-125120-mongoose-sanitizefilter-not-applied-on-countdocuments)
- [Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.](https://junglewise.ai/threats/cve-2026-125119-mongoose-connection-level-sanitizefilter-not-applied)
- [Mongoose prototype pollution in Schema.prototype.virtual()](https://junglewise.ai/threats/cve-2026-125118-mongoose-prototype-pollution-via-schema-prototype-virtual)
- [Mongoose prototype pollution in object initialization](https://junglewise.ai/threats/cve-2026-125117-mongoose-is-a-mongodb-object-modeling-tool-designed-to-work-in)
- [Mongoose discriminator key inheritance bypass](https://junglewise.ai/threats/cve-2026-125116-mongoose-discriminator-key-values-matching-inherited-properties)