Malware in awaitly-mongo
The npm package awaitly-mongo was found to contain malware, resulting in full system compromise for any computer with the package installed or running. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a different computer.
- Disclosed
- Last updated
- Blast radius
- Any system with awaitly-mongo installed or running
- Ecosystems
- Attack vectors
- Affected entities
- awaitly-mongonpm package
The npm package awaitly-mongo was identified as containing malware. According to the GitHub Security Advisory (GHSA-4vpc-g7mx-4m5v), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends immediate action: all secrets and keys stored on affected computers should be rotated immediately from a different, unaffected computer. While the package should be removed, the advisory notes that full control of the computer may have been given to an outside entity, meaning there is no guarantee that removing the package will remove all malicious software resulting from the installation.\n\nThis represents a critical supply chain attack through a compromised npm package with potential for widespread impact across development and production environments.
Indicators of compromise
- Packages
- awaitly-mongo
Remediation
- Immediately remove the awaitly-mongo package from all affected systems
- Rotate all secrets, API keys, credentials, and signing keys from a different, unaffected computer
- Assume full system compromise and conduct a thorough security audit of affected machines
- Review system logs and network traffic for signs of unauthorized access or data exfiltration
- Consider rebuilding affected systems from clean media if possible
- Notify all users and stakeholders who may have been affected by systems running this package
Sources
- GitHub Advisory GHSA-4vpc-g7mx-4m5v · GitHub Advisory Database
Cite this entry
"Malware in awaitly-mongo." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 30, 2026; last updated June 30, 2026. https://supplychainattack.org/incident/malware-in-awaitly-mongo-190ak5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in testingsmthb1g (npm)
The npm package testingsmthb1g contains malicious code in its postinstall script that acts as an install-time dropper, downloading and executing a Windows binary payload and exfiltrating platform information. The attack includes sandbox escape capabilities for WSL/virtualized Linux environments.
npmCompromised package - resolvedcritical
Malicious code in mutex-core (npm)
The npm package mutex-core, published under a name resembling the popular async-mutex library, contained malicious code including a staged loader that decrypts and executes hidden payloads. The package included obfuscated code that conditionally triggers AES-256-GCM decryption and execution of encrypted binary content when specific conditions are met.
npmCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit