Encyclopedia
npm◆ MEDIUMtyposquat⚠ ACTIVE THREAT

mongose

First seen: Sep 27, 2026 0 viewsMimics: mongoose
Share threatHN
Threat Description

A typosquat of the MongoDB ODM mongoose from the August 2017 npm typosquat campaign. It impersonated the popular library with a missing 'o' (mongose vs mongoose), amassing around 196 downloads, and carried the campaign's data-collection payload.

AI Hallucination Analysis
Unlikely AI Hallucination0%
Known to be hallucinated by: None - this is a real typosquat, not an AI hallucination.
Remediation Guide
  1. Remove mongose and install the legitimate mongoose. 2. Rotate npm tokens exposed during the window. 3. Audit for typosquatted dependency names. 4. Pin dependencies by hash.
View on registry
Quick Facts
Ecosystem
npm
Risk Level
MEDIUM
Type
typosquat
Status
ACTIVE
Legitimate Package
mongoose
Hallucination Confidence
0%
Check My Project
Scan for this package