Mongoose
npmmongooseMongoose is the standard ODM (Object Document Mapper) for MongoDB in Node.js, providing schema definition, validation, and query building. It is used in Express, NestJS, and Next.js applications that store data in MongoDB. Mongoose reads the MongoDB connection URI from application code or environment variables.
Checking Mongoose
mongoose 8.5.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=mongoose&version=8.5.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "mongoose",
"version": "8.5.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
Mongoose holds the MongoDB URI, which often embeds username and password. Compromise can leak that URI and issue arbitrary queries against the production cluster.
Attestd monitors mongoose using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.