react-jsonwebtoken@9.0.3

Analysis

Package react-jsonwebtoken@9.0.3 is a trojanized clone of the legitimate jsonwebtoken library. On require(), decode.js fetches a second-stage payload from hxxps://jsonkeeper[.]com/b/E69V3 and executes it via the Function constructor with full require access, enabling arbitrary code execution under the attacker's control. The package has no repository and uses a version-confusion pattern (9.0.3 on first publish) to trick installers.