MAL-2026-10184

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mongoose-schema-unique/MAL-2026-10184.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10184
Published
2026-07-10T22:42:27Z
Modified
2026-07-10T23:01:53Z
Summary
Malicious code in mongoose-schema-unique (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca)

index.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable, public JSON-paste service) and forwards the response's data.data field to a worker thread via worker.postMessage({ type: 'RUN_ERROR_THREAD', payload: data.data }). The referenced worker module (./worker-singleton) is not present in the tarball. Every require('mongoose-schema-unique') triggers this fetch, and the paste host lets whoever controls the paste ID substitute new content at any time without a package release, so the payload dispatched into worker execution is attacker-mutable. The behavior is unrelated to the package's documented purpose (a Mongoose uniqueness-validation plugin). The 4.0.3 release also changes the repository URL to a new mongoose-schema-unique/mongoose-schema-unique GitHub org while keeping the original author metadata and jumps the major version with a mongoose ^8 peer dependency — consistent with a name/maintainer takeover of an established package used to ship an import-time remote-code delivery channel to downstream installers.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-009722",
            "import_time":  "2026-07-10T22:50:18.489268467Z",
            "modified_time":  "2026-07-10T22:42:35Z",
            "sha256":  "7ce7507c96fde82f5149a4d2277846bd6a257d188b3253b772b7e84a4484940d",
            "source":  "amazon-inspector",
            "versions":  [
                "4.0.4"
            ]
        },
        {
            "id":  "IN-MAL-2026-009721",
            "import_time":  "2026-07-10T22:50:18.391806282Z",
            "modified_time":  "2026-07-10T22:42:27Z",
            "sha256":  "7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca",
            "source":  "amazon-inspector",
            "versions":  [
                "4.0.3"
            ]
        },
        {
            "id":  "IN-MAL-2026-009725",
            "import_time":  "2026-07-10T22:50:18.865853857Z",
            "modified_time":  "2026-07-10T22:43:03Z",
            "sha256":  "ae9339a874c589bcd7c0df518d00927173946d905da93f1b6fd5d97b5c9c787e",
            "source":  "amazon-inspector",
            "versions":  [
                "4.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mongoose-schema-unique

Package

Name
mongoose-schema-unique
View open source insights on deps.dev
Purl
pkg:npm/mongoose-schema-unique

Affected ranges

Affected versions

4.*
4.0.2
4.0.3
4.0.4

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "8e901f519d51fa581787f8173de1ab9c4526cbdd5c3db9eb1dd851f0143bd4ec",
            "tlsh":  "a402354a05661625887763b1bb97a40ff723c0e33740d759beac13a01f7681486abfde"
        },
        {
            "path":  "worker.js",
            "sha256":  "029b0550c0406f39dcc08b78edcd5bc1ca91ab66595593210b811e480ebb1d54",
            "tlsh":  "ccf0ebcb9c6820259eb63752abb37515f503a17322c183b5b79c21b00f72bc05033fa8"
        },
        {
            "path":  "CHANGELOG.md",
            "sha256":  "12e7fef70d18e23c09ceaf706309dd1f28d8611f72ab10f8805e5b57b5dd3e6f",
            "tlsh":  "b12135a23059f23708b3107174dfb4f33d198068df5a355d96cc814c521a855dbbf629"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "mongoose-schema-unique-4.0.4.tgz",
            "hashes":  {
                "sha1":  "026b68e794711a6f2597ee0e5e62d8c16ff5f43a",
                "sha512_sri":  "sha512-ixm4CHa0Yk89w8hGOgSZDbdpGa4iIsWkQiiLRpPXQ9ThHeWsUg+VB7GJHUMCdZIKc4j2jgU1yRIOMSMtrn/H5A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mongoose-schema-unique/MAL-2026-10184.json"