mongoose-schema-unique@4.0.4

Analysis

On module load, mongoose-schema-unique@4.0.4 fetches a remote JSON payload from hxxps://www[.]jsonkeeper[.]com/b/XVHGD and executes the returned data as arbitrary JavaScript code inside a Node.js worker thread via new Function("require", payload). The C2 host is www[.]jsonkeeper[.]com. The package ships worker.js and worker-singleton.js which implement the remote code execution channel: worker-singleton.js spawns a Worker thread from worker.js, and worker.js listens for messages and evaluates the received payload using the Function constructor with access to require.