Critical Malicious Code Vulnerability in node-mongo-orm Package
Summary
MAL-2025-5940: Malicious code in node-mongo-orm (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-mongo-orm is an npm package designed to provide a simple and efficient Object-Relational Mapping (ORM) interface for MongoDB. It allows developers to interact with MongoDB databases using JavaScript objects, streamlining database operations. However, this package has been identified to contain malicious code, posing significant security risks to any application utilizing it.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the node-mongo-orm package. This code can compromise any computer that has the package installed, leading to unauthorized access and control over the system. The ramifications include potential data breaches, loss of sensitive information, and the risk of further malware installation. The vulnerability is classified under CWE-506, indicating that the code appears to be malicious in nature.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-mongo-ormIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using an alternative ORM package that does not have known vulnerabilities. Additionally, ensure that all secrets and keys stored on the affected computer are rotated immediately to mitigate any potential risks.
Conclusion
The node-mongo-orm package contains a critical vulnerability due to embedded malicious code, which poses significant risks to any system using it. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to monitor for updates and consider alternative packages.
See every vulnerability recorded for node-mongo-orm →
FAQ
node-mongo-orm is an npm package that provides an Object-Relational Mapping interface for MongoDB, allowing developers to interact with databases using JavaScript objects.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
If you have the node-mongo-orm package installed, you should remove it immediately and rotate any sensitive information stored on the affected system.
Currently, there is no patched version available for the node-mongo-orm package. It is recommended to monitor the package's repository for any updates.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
