mongoose-lean-hooks@0.5.2

Analysis

Package takeover of mongoose-lean-hooks. index.js contains a hidden second-stage dropper appended after the legitimate plugin code: it uses axios to fetch remote code from jsonkeeper[.]com/b/A5BA8, then executes it via new Function('require', res.data.data). The declared dependencies (axios, request, sqlite3) are unnecessary for the claimed Mongoose timestamp-plugin purpose. The dropper is a C2 channel: fetch remote payload, then evaluate it at runtime with access to require, enabling arbitrary code execution in the installer's environment.