Critical Malicious Code Vulnerability in Morgan.js Package
Summary
MAL-2026-536: Malicious code in morgan.js (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Morgan.js is a popular logging middleware for Node.js applications, designed to simplify the logging of HTTP requests. It provides various logging formats and is widely used in web applications to track incoming requests and responses. However, the package has been compromised, leading to a severe security vulnerability that can fully compromise any system running it.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the Morgan.js package. This code can grant unauthorized access to the system, allowing attackers to control the affected machine completely. As a result, any sensitive information, including secrets and keys stored on the computer, is at risk. The malicious nature of this code is classified under CWE-506, indicating that it contains embedded malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall morgan.jsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily disable the use of Morgan.js in your application until the package is removed or updated. This can be done by commenting out the import statement and any middleware usage in your application code.
Conclusion
The discovery of malicious code in the Morgan.js package poses a significant threat to any system utilizing it. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for morgan.js →
FAQ
Morgan.js is a logging middleware for Node.js that helps developers log HTTP requests in their applications.
You can check if your application is affected by using Vulert, which monitors vulnerabilities in open-source packages. Visit Vulert Scanner to analyze your package-lock.json file.
If you have installed Morgan.js, you should remove it immediately and rotate any sensitive information stored on your system.
Currently, there is no patch available for Morgan.js due to the nature of the compromise. The best course of action is to remove the package.
Yes, you can continue using your application without Morgan.js by disabling it temporarily until a safe alternative is found.
