npm - OSV

GHSA-qqmp-wf37-98f9

npm/@opentelemetry/instrumentation-cassandra-driver
npm/@opentelemetry/instrumentation-knex
npm/@opentelemetry/instrumentation-mongoose
npm/@opentelemetry/instrumentation-mysql
npm/@opentelemetry/instrumentation-mysql2
... 3 more

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 5 hours ago

Fix available
Severity - 5.8 (Medium)

MAL-2026-15845

npm/react-mongoose

Malicious code in react-mongoose (npm) 01 Sep

No fix available

GHSA-664h-wqgq-64gw

npm/mongoose

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) 24 Jul

Fix available
Severity - 6.5 (Medium)

MAL-2026-10184

npm/mongoose-schema-unique

Malicious code in mongoose-schema-unique (npm) 10 Jul

No fix available

MAL-2026-6797

npm/mongoose-lean-hooks

Malicious code in mongoose-lean-hooks (npm) 06 Jul

No fix available

MAL-2026-6499

npm/mongoose-json-format

Malicious code in mongoose-json-format (npm) 26 Jun

No fix available

MAL-2026-6203

npm/mongoose-jsonify

Malicious code in mongoose-jsonify (npm) 19 Jun

No fix available

MAL-2026-5225

npm/autotel-mongoose

Malicious code in autotel-mongoose (npm) 05 Jun

No fix available

GHSA-wpg9-53fq-2r8h

npm/mongoose

Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection 05 May

Fix available
Severity - 7.5 (High)

MAL-2026-2675

npm/mongoose-stamps

Malicious code in mongoose-stamps (npm) 15 Apr

No fix available

MAL-2026-1200

npm/mongoose-apis

Malicious code in mongoose-apis (npm) 03 Mar

No fix available

MAL-2025-192398

npm/database-mongoose-kit

Malicious code in database-mongoose-kit (npm) 10 Dec 2025

No fix available

MAL-2025-190679

npm/@trigo/atrix-mongoose

Malicious code in @trigo/atrix-mongoose (npm) 24 Nov 2025

No fix available

MAL-2025-190692

npm/atrix-mongoose

Malicious code in atrix-mongoose (npm) 24 Nov 2025

No fix available

MAL-2025-190560

npm/mongoose-odm

Malicious code in mongoose-odm (npm) 18 Nov 2025

No fix available

MAL-2025-186059

npm/centaurus-biohacking-mongoose-nova

Malicious code in centaurus-biohacking-mongoose-nova (npm) 13 Nov 2025

No fix available

Vulnerabilities