jwtmethod@1.1.10

Analysis

jwtmethod@1.1.10 is a combosquat package that masquerades as a JWT library (fake author "auth0", fake repository URL). On require(), decode.js immediately fetches a remote payload from hxxps://jsonkeeper[.]com/b/E69V3 and executes it via new Function.constructor with full Node.js require() access — a remote code execution dropper that allows the attacker to run arbitrary code on the installer's system.