Supply chain · npm · High

Critical Malicious 'react-mongoose' npm Package Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-09-01

A critical malicious 'react-mongoose' npm package has been identified, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further action due to potential persistent compromise.

  • Package: npm / react-mongoose
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~19/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'react-mongoose' npm package has been identified as malicious. Any system where this package has been installed or run should be considered fully compromised, indicating an attacker has gained unauthorized access and control.

How the attack works

This is a supply-chain attack where a seemingly legitimate software package contains hidden malicious code. When the package is installed and executed, it performs unauthorized actions, potentially establishing persistence and exfiltrating sensitive data from the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has 'react-mongoose' as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependency versions in package.json (e.g., using `*` or `latest`)
  • Lack of package-lock.json or yarn.lock files to ensure deterministic builds
  • Use of internal package mirrors that do not vet upstream packages
  • Automated build processes that install dependencies without review

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, lateral movement within the network, or further malware deployment.
  • All secrets (e.g., API keys, credentials, tokens) stored on the compromised computer are exposed and can be used by the attacker.
  • The integrity of development environments and production systems is compromised, potentially leading to backdoored applications or data breaches.

What to do (defensive)

Detect

  • Review dependency trees for 'react-mongoose' in all projects using npm.
  • Scan project dependencies using software composition analysis (SCA) tools for known malicious packages.
  • Monitor network traffic for unusual outbound connections from systems where 'react-mongoose' might have been installed.

Contain

  • Immediately isolate any system identified with 'react-mongoose' installed from the network.
  • Block 'react-mongoose' from being downloaded or installed in your organization's package registries or proxies.
  • Suspend any CI/CD pipelines that might be installing this package.

Remediate

  • Consider any system that installed 'react-mongoose' as fully compromised and re-image it from a trusted source.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, database credentials) that were stored on or accessible from compromised systems, performing this action from a different, trusted computer.
  • Remove the 'react-mongoose' package from all affected projects and systems; however, be aware that this alone may not fully remove all malicious components due to potential persistence mechanisms.

Frontier verdict — High

Prioritize immediate investigation and remediation for 'react-mongoose' due to critical severity and full system compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.