The mongoose-json-format package (version 3.0.1) includes code in helpers.js that, upon require(), instantiates a Helper object whose constructor calls createLog(). This function base64-decodes a string named HASH_KEY to obtain a URL (https://www.jsonkeeper.com/b/XVHGD) pointing to an anonymous mutable JSON paste host. The package fetches this URL and passes the response's data.data field to createLogger() from the log-format-thread dependency. Since the content at jsonkeeper.com is attacker-mutable, this allows arbitrary attacker-controlled content to be delivered and processed at import time, effectively turning any consumer of this package into a vehicle for executing malicious content.

Any application that includes mongoose-json-format version 3.0.1 as a dependency and requires it will execute attacker-controlled content fetched at runtime from a mutable external source. This can lead to arbitrary code execution or other malicious behaviors depending on the content delivered and how the downstream dependency processes it. The malicious behavior occurs immediately upon import, making it a supply chain risk.

No official patch or remediation is currently documented. Users should avoid using mongoose-json-format version 3.0.1. Since this is a malicious package, removing it from dependencies and replacing it with a trusted alternative is recommended. Monitor vendor advisories for any updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.