Skip to main content
MalwarePublished Updated

express-mongo-limit (npm) · Malicious Code

Affects express-mongo-limitSource GCVE Database

0

Malicious package : remove express-mongo-limit and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 18:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-7012

What to do

Remove express-mongo-limit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmexpress-mongo-limitAffected
  • 2.0.1 – 2.0.6
6 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package express-mongo-limit is a malicious typosquatting package masquerading as a payload sanitization middleware. It executes a postinstall script that installs persistent malware including a clipboard hijacker that replaces cryptocurrency wallet addresses with attacker-controlled addresses, a spyware component that takes desktop screenshots every 2 seconds and emails them to the attacker, and an environment variable exfiltration backdoor. The malware achieves persistence by globally installing dependencies and registering a background service with pm2. The package was published by a malicious actor under the npm user jon_conway.

References

Community reviews

Loading reviews…