Critical Malicious Code Vulnerability in atrix-mongoose Package
Summary
MAL-2025-190692: Malicious code in atrix-mongoose (npm). Affects atrix-mongoose versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The atrix-mongoose package is a Node.js library that facilitates interactions with MongoDB databases. It is designed to streamline database operations and enhance application performance. However, this package has been identified as containing malicious code, which poses significant security risks to any system using it.
Vulnerability Detail
The atrix-mongoose package has been compromised with embedded malicious code, which allows unauthorized access and control over any computer that has this package installed. The vulnerability originates from a malicious actor who has injected harmful code into the package, leading to potential data breaches and loss of sensitive information. Users should consider any system running this package as fully compromised, necessitating immediate action to secure their environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall atrix-mongooseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the atrix-mongoose package and securing your environment. Ensure that all sensitive data is rotated and monitored for any unauthorized access.
Conclusion
The atrix-mongoose package has been identified as containing malicious code, posing serious security risks. Immediate removal of the package and rotation of sensitive information is essential to mitigate potential damage. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for atrix-mongoose →
FAQ
Immediately remove the atrix-mongoose package from your system and rotate all sensitive keys and secrets.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Failure to address this vulnerability can lead to unauthorized access to your system, data breaches, and potential loss of sensitive information.
Currently, there is no patched version available. The best course of action is to remove the package entirely.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities in your software, providing an easy way to stay informed.
