The mongoose-schema-unique npm package versions 4.0.2 through 4.0.4 include an asynchronous immediately-invoked function expression (IIFE) that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD, a mutable public JSON paste service. The fetched data's 'data.data' field is forwarded to a worker thread via postMessage for execution. The worker module is absent from the package tarball, enabling the attacker to modify the payload at any time without releasing a new package version. This malicious behavior diverges from the package's documented purpose and coincides with a repository URL change and major version bump, consistent with a takeover of the package to deliver remote code execution through dynamic payloads.

Any project importing mongoose-schema-unique versions 4.0.2, 4.0.3, or 4.0.4 will execute attacker-controlled code fetched at runtime from a public JSON paste service. This creates a remote code execution vector that can be updated by the attacker without any new package release, posing a significant risk to the confidentiality, integrity, and availability of affected systems.

No official patch or remediation is currently documented. Users should immediately stop using mongoose-schema-unique versions 4.0.2, 4.0.3, and 4.0.4. Replace the package with a known good alternative or revert to a version prior to the malicious releases if available and verified safe. Monitor vendor advisories for updates or official fixes. Consider removing the package entirely if its functionality is not critical.