MAL-2025-5829 Malicious code in node-mongoose-orm (npm)
Malicious package
Published
MAL-2025-5829 is a malicious package: node-mongoose-orm (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2025-5829/ (Markdown: https://insights.sbomify.com/MAL-2025-5829/index.md)
- Package
- node-mongoose-orm
- Registry
- npm
What is MAL-2025-5829?
MAL-2025-5829 is a malicious package in node-mongoose-orm, published on 2 Jul 2025.
Official description
The package employs typosquatting to impersonate a legitimate author and package, and it contains obfuscated code that exfiltrates sensitive user data and creates a backdoor for remote code execution, The core of the malicious activity is found in the
package/lib/writer.js file. The lib/writer.js file contains obfuscated code that collects and exfiltrates data. It collects sensitive information: environment variables, OS platform, hostname, username, and MAC addresses. Sends this information via a POST request to https://log-server-lovat.vercel.app/api/ipcheck/703. The most dangerous part is eval(r.data). This is a remote code execution (RCE) vulnerability. The server can send back any JavaScript code, and it will be executed on the user's machineWhat should I do about MAL-2025-5829?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.