Malicious code in react-mongoose (npm)

The react-mongoose npm package versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.5 have been identified as containing malicious code or depending on malicious code. Systems with this package installed or running should be considered fully compromised, as the malicious code may provide attackers with full control. The package is flagged by multiple sources including Amazon Inspector and GHSA malware advisories. There is no CVSS score available for this threat. No official patch or remediation is indicated in the data.

Any computer with the affected react-mongoose package installed or running is considered fully compromised. Attackers may have gained full control, potentially exposing all stored secrets and keys. The compromise is severe enough that simply removing the package may not restore system integrity.

Remove the react-mongoose package immediately from all affected systems. Rotate all secrets and keys from a separate, uncompromised machine. Due to the potential for persistent malicious software, consider full system reimaging or forensic analysis to ensure complete remediation. No official patch or fix is currently available.