Critical Remote Code Execution Vulnerability in node-mongoose-orm Package
Summary
MAL-2025-5829: Malicious code in node-mongoose-orm (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-mongoose-orm package is an npm library designed to facilitate object-relational mapping for Node.js applications, allowing developers to interact with databases using JavaScript objects. However, this package has been found to contain malicious code that compromises user security, making it susceptible to serious vulnerabilities.
Vulnerability Detail
The vulnerability stems from the package's use of typosquatting, impersonating a legitimate package and author. It contains obfuscated code in the 'package/lib/writer.js' file that collects sensitive user data, including environment variables, OS platform, hostname, username, and MAC addresses. This information is sent via a POST request to a remote server. The most critical aspect is the use of 'eval(r.data)', which allows for remote code execution (RCE), enabling attackers to execute arbitrary JavaScript code on the user's machine.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall node-mongoose-ormIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the node-mongoose-orm package from your project until a secure version is available. Use the following command to uninstall it: 'npm uninstall node-mongoose-orm'.
Conclusion
The node-mongoose-orm package contains a critical vulnerability that poses significant risks to users by allowing remote code execution and data exfiltration. It is crucial to update or remove the package to mitigate these risks and safeguard your application.
See every vulnerability recorded for node-mongoose-orm →
FAQ
Typosquatting is a malicious practice where attackers create packages with names similar to legitimate ones, hoping users will mistakenly install them.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The malicious code collects sensitive information such as environment variables, OS platform, hostname, username, and MAC addresses.
Remote code execution allows attackers to run arbitrary code on a user's machine, potentially leading to data theft, system compromise, or further exploitation.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and ensure you only install packages from trusted sources.
