Malicious Code Detected in mongodb-compass: A Critical Vulnerability
Summary
MAL-2025-191518: Malicious code in mongodb-compass (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mongodb-compass is a graphical user interface for MongoDB, designed to simplify database management and data visualization. It allows users to interact with their MongoDB databases through a user-friendly interface, providing features such as query building, data exploration, and performance monitoring. However, recent findings have revealed that this package contains malicious code, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from the discovery of malicious code within the mongodb-compass package. This code can potentially compromise user data, lead to unauthorized access, and exploit system resources. The malicious nature of this code raises serious concerns about the integrity and security of applications relying on this package, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mongodb-compassIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the mongodb-compass package until a secure version is confirmed. Alternatively, consider using other database management tools that do not exhibit this vulnerability.
Conclusion
The discovery of malicious code in the mongodb-compass package highlights the importance of maintaining vigilance regarding open-source software security. Users are strongly advised to update their packages promptly and consider alternative solutions until the issue is fully resolved.
See every vulnerability recorded for mongodb-compass →
FAQ
mongodb-compass is a GUI tool for MongoDB that helps users manage their databases more effectively.
The malicious code was identified through an automated security assessment conducted by Amazon Inspector.
Using the compromised version can lead to data breaches, unauthorized access, and potential system exploitation.
Yes, users should update to the latest version of mongodb-compass to mitigate the risks associated with this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
