MAL-2026-10184

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mongoose-schema-unique/MAL-2026-10184.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10184
Published
2026-07-10T22:42:27Z
Modified
2026-07-10T23:01:53.968826038Z
Summary
Malicious code in mongoose-schema-unique (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca)

index.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable, public JSON-paste service) and forwards the response's data.data field to a worker thread via worker.postMessage({ type: 'RUN_ERROR_THREAD', payload: data.data }). The referenced worker module (./worker-singleton) is not present in the tarball. Every require('mongoose-schema-unique') triggers this fetch, and the paste host lets whoever controls the paste ID substitute new content at any time without a package release, so the payload dispatched into worker execution is attacker-mutable. The behavior is unrelated to the package's documented purpose (a Mongoose uniqueness-validation plugin). The 4.0.3 release also changes the repository URL to a new mongoose-schema-unique/mongoose-schema-unique GitHub org while keeping the original author metadata and jumps the major version with a mongoose ^8 peer dependency — consistent with a name/maintainer takeover of an established package used to ship an import-time remote-code delivery channel to downstream installers.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-10T22:50:18.489268467Z",
            "sha256": "7ce7507c96fde82f5149a4d2277846bd6a257d188b3253b772b7e84a4484940d",
            "modified_time": "2026-07-10T22:42:35Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009722",
            "versions": [
                "4.0.4"
            ]
        },
        {
            "import_time": "2026-07-10T22:50:18.391806282Z",
            "sha256": "7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca",
            "modified_time": "2026-07-10T22:42:27Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009721",
            "versions": [
                "4.0.3"
            ]
        },
        {
            "import_time": "2026-07-10T22:50:18.865853857Z",
            "sha256": "ae9339a874c589bcd7c0df518d00927173946d905da93f1b6fd5d97b5c9c787e",
            "modified_time": "2026-07-10T22:43:03Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009725",
            "versions": [
                "4.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mongoose-schema-unique

Package

Name
mongoose-schema-unique
View open source insights on deps.dev
Purl
pkg:npm/mongoose-schema-unique

Affected ranges

Affected versions

4.*
4.0.2
4.0.3
4.0.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mongoose-schema-unique/MAL-2026-10184.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "8e901f519d51fa581787f8173de1ab9c4526cbdd5c3db9eb1dd851f0143bd4ec",
            "path": "index.js",
            "tlsh": "a402354a05661625887763b1bb97a40ff723c0e33740d759beac13a01f7681486abfde"
        },
        {
            "sha256": "029b0550c0406f39dcc08b78edcd5bc1ca91ab66595593210b811e480ebb1d54",
            "path": "worker.js",
            "tlsh": "ccf0ebcb9c6820259eb63752abb37515f503a17322c183b5b79c21b00f72bc05033fa8"
        },
        {
            "sha256": "12e7fef70d18e23c09ceaf706309dd1f28d8611f72ab10f8805e5b57b5dd3e6f",
            "tlsh": "b12135a23059f23708b3107174dfb4f33d198068df5a355d96cc814c521a855dbbf629",
            "path": "CHANGELOG.md"
        }
    ],
    "package_integrity": [
        {
            "filename": "mongoose-schema-unique-4.0.4.tgz",
            "hashes": {
                "sha1": "026b68e794711a6f2597ee0e5e62d8c16ff5f43a",
                "sha512_sri": "sha512-ixm4CHa0Yk89w8hGOgSZDbdpGa4iIsWkQiiLRpPXQ9ThHeWsUg+VB7GJHUMCdZIKc4j2jgU1yRIOMSMtrn/H5A=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]