{"id":"MAL-2026-10184","summary":"Malicious code in mongoose-schema-unique (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca)\nindex.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable, public JSON-paste service) and forwards the response's `data.data` field to a worker thread via `worker.postMessage({ type: 'RUN_ERROR_THREAD', payload: data.data })`. The referenced worker module (`./worker-singleton`) is not present in the tarball. Every `require('mongoose-schema-unique')` triggers this fetch, and the paste host lets whoever controls the paste ID substitute new content at any time without a package release, so the payload dispatched into worker execution is attacker-mutable. The behavior is unrelated to the package's documented purpose (a Mongoose uniqueness-validation plugin). The 4.0.3 release also changes the repository URL to a new `mongoose-schema-unique/mongoose-schema-unique` GitHub org while keeping the original author metadata and jumps the major version with a `mongoose ^8` peer dependency — consistent with a name/maintainer takeover of an established package used to ship an import-time remote-code delivery channel to downstream installers.\n","modified":"2026-07-10T23:01:53.968826038Z","published":"2026-07-10T22:42:27Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-10T22:50:18.489268467Z","modified_time":"2026-07-10T22:42:35Z","sha256":"7ce7507c96fde82f5149a4d2277846bd6a257d188b3253b772b7e84a4484940d","source":"amazon-inspector","versions":["4.0.4"],"id":"IN-MAL-2026-009722"},{"source":"amazon-inspector","versions":["4.0.3"],"id":"IN-MAL-2026-009721","import_time":"2026-07-10T22:50:18.391806282Z","modified_time":"2026-07-10T22:42:27Z","sha256":"7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca"},{"import_time":"2026-07-10T22:50:18.865853857Z","modified_time":"2026-07-10T22:43:03Z","sha256":"ae9339a874c589bcd7c0df518d00927173946d905da93f1b6fd5d97b5c9c787e","source":"amazon-inspector","versions":["4.0.2"],"id":"IN-MAL-2026-009725"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mongoose-schema-unique/v/4.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/mongoose-schema-unique/v/4.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/mongoose-schema-unique/v/4.0.2"}],"affected":[{"package":{"name":"mongoose-schema-unique","ecosystem":"npm","purl":"pkg:npm/mongoose-schema-unique"},"versions":["4.0.4","4.0.3","4.0.2"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"8e901f519d51fa581787f8173de1ab9c4526cbdd5c3db9eb1dd851f0143bd4ec","tlsh":"a402354a05661625887763b1bb97a40ff723c0e33740d759beac13a01f7681486abfde"},{"path":"worker.js","sha256":"029b0550c0406f39dcc08b78edcd5bc1ca91ab66595593210b811e480ebb1d54","tlsh":"ccf0ebcb9c6820259eb63752abb37515f503a17322c183b5b79c21b00f72bc05033fa8"},{"sha256":"12e7fef70d18e23c09ceaf706309dd1f28d8611f72ab10f8805e5b57b5dd3e6f","tlsh":"b12135a23059f23708b3107174dfb4f33d198068df5a355d96cc814c521a855dbbf629","path":"CHANGELOG.md"}],"package_integrity":[{"filename":"mongoose-schema-unique-4.0.4.tgz","hashes":{"sha1":"026b68e794711a6f2597ee0e5e62d8c16ff5f43a","sha512_sri":"sha512-ixm4CHa0Yk89w8hGOgSZDbdpGa4iIsWkQiiLRpPXQ9ThHeWsUg+VB7GJHUMCdZIKc4j2jgU1yRIOMSMtrn/H5A=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mongoose-schema-unique/MAL-2026-10184.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}