The react-jsonwebtoken package, which mimics the widely-used jsonwebtoken library and falsely claims 'auth0' as author, contains a require-time remote code execution backdoor. Upon loading, it calls a helper function that performs an HTTPS GET request to a mutable anonymous paste endpoint, retrieves JavaScript code, and executes it using indirect Function construction with access to the host's require function. This grants the remote code full Node.js capabilities on the consumer's machine. The attack leverages impersonation and obfuscation to evade detection, constituting a clear supply-chain compromise in versions 9.0.3, 9.0.4, and 9.0.5 of react-jsonwebtoken.

Any system that installs and requires the affected versions of react-jsonwebtoken will execute arbitrary remote code with full Node.js privileges, potentially leading to complete system compromise. The malicious code is loaded silently at require-time, enabling attackers to run any code on the host environment without user consent or awareness.

No official patch or remediation is currently documented. Users should immediately stop using react-jsonwebtoken versions 9.0.3, 9.0.4, and 9.0.5. Remove the package from all projects and dependency trees. Verify that no malicious code has been executed or persisted on affected systems. Prefer the legitimate jsonwebtoken package from trusted sources. Monitor vendor advisories for updates or official fixes.