{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "8e901f519d51fa581787f8173de1ab9c4526cbdd5c3db9eb1dd851f0143bd4ec",
              "tlsh": "a402354a05661625887763b1bb97a40ff723c0e33740d759beac13a01f7681486abfde"
            },
            {
              "path": "worker.js",
              "sha256": "029b0550c0406f39dcc08b78edcd5bc1ca91ab66595593210b811e480ebb1d54",
              "tlsh": "ccf0ebcb9c6820259eb63752abb37515f503a17322c183b5b79c21b00f72bc05033fa8"
            },
            {
              "path": "CHANGELOG.md",
              "sha256": "12e7fef70d18e23c09ceaf706309dd1f28d8611f72ab10f8805e5b57b5dd3e6f",
              "tlsh": "b12135a23059f23708b3107174dfb4f33d198068df5a355d96cc814c521a855dbbf629"
            }
          ],
          "package_integrity": [
            {
              "filename": "mongoose-schema-unique-4.0.4.tgz",
              "hashes": {
                "sha1": "026b68e794711a6f2597ee0e5e62d8c16ff5f43a",
                "sha512_sri": "sha512-ixm4CHa0Yk89w8hGOgSZDbdpGa4iIsWkQiiLRpPXQ9ThHeWsUg+VB7GJHUMCdZIKc4j2jgU1yRIOMSMtrn/H5A=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "mongoose-schema-unique"
      },
      "versions": [
        "4.0.4",
        "4.0.3",
        "4.0.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-009722",
        "import_time": "2026-07-10T22:50:18.489268467Z",
        "modified_time": "2026-07-10T22:42:35Z",
        "sha256": "7ce7507c96fde82f5149a4d2277846bd6a257d188b3253b772b7e84a4484940d",
        "source": "amazon-inspector",
        "versions": [
          "4.0.4"
        ]
      },
      {
        "id": "IN-MAL-2026-009721",
        "import_time": "2026-07-10T22:50:18.391806282Z",
        "modified_time": "2026-07-10T22:42:27Z",
        "sha256": "7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca",
        "source": "amazon-inspector",
        "versions": [
          "4.0.3"
        ]
      },
      {
        "id": "IN-MAL-2026-009725",
        "import_time": "2026-07-10T22:50:18.865853857Z",
        "modified_time": "2026-07-10T22:43:03Z",
        "sha256": "ae9339a874c589bcd7c0df518d00927173946d905da93f1b6fd5d97b5c9c787e",
        "source": "amazon-inspector",
        "versions": [
          "4.0.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7e3806417e775917428aeea0eb50ecbfec0bc2220282bee33f4138ff43e80dca)\nindex.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable, public JSON-paste service) and forwards the response\u0027s `data.data` field to a worker thread via `worker.postMessage({ type: \u0027RUN_ERROR_THREAD\u0027, payload: data.data })`. The referenced worker module (`./worker-singleton`) is not present in the tarball. Every `require(\u0027mongoose-schema-unique\u0027)` triggers this fetch, and the paste host lets whoever controls the paste ID substitute new content at any time without a package release, so the payload dispatched into worker execution is attacker-mutable. The behavior is unrelated to the package\u0027s documented purpose (a Mongoose uniqueness-validation plugin). The 4.0.3 release also changes the repository URL to a new `mongoose-schema-unique/mongoose-schema-unique` GitHub org while keeping the original author metadata and jumps the major version with a `mongoose ^8` peer dependency \u2014 consistent with a name/maintainer takeover of an established package used to ship an import-time remote-code delivery channel to downstream installers.\n",
  "id": "MAL-2026-10184",
  "modified": "2026-07-10T22:52:15Z",
  "published": "2026-07-10T22:42:27Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/mongoose-schema-unique/v/4.0.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/mongoose-schema-unique/v/4.0.3"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/mongoose-schema-unique/v/4.0.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in mongoose-schema-unique (npm)"
}