MQTT.js
npmmqttMQTT.js is the standard MQTT client library for Node.js and browser environments, used in IoT device communication, telemetry pipelines, and home automation systems. It connects to MQTT brokers (Mosquitto, HiveMQ, AWS IoT) and subscribes to and publishes messages on topics.
Checking MQTT.js
mqtt 5.10.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=mqtt&version=5.10.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "mqtt",
"version": "5.10.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
MQTT.js connects to brokers such as Mosquitto, HiveMQ, or AWS IoT with passwords or client certificates. A hostile client can steal those credentials and subscribe to every topic the device identity can read, including telemetry and control messages.
Attestd monitors mqtt using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.