Confirmed malicious. Do not install it, and remove it where it has been installed.
malware. Confirmed 2025-08-14, OSV malicious-package feed (Google / OpenSSF).
The package mogodb-core was found to contain malicious code.
Remove it from every machine and lockfile it reached. Treat any credentials, tokens and SSH keys present on those machines as exposed and rotate them. Check CI runners and container images that installed it.
npm uninstall mogodb-core
0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
severity band, no base score published
chance of exploitation in 30 days
CyberXYZ composite out of 10
fig. 01 — GHSA-g4m3-rpxr-h7vg, the advisory selected below
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.
// recommendationRemove the package from your environment. There are no indications of further compromise.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Checked 2026-10-04 at 01:14 UTC. The most recent advisory here was published 2020-09-03. Updated continuously from NVD, GHSA, OSV and CNA feeds.