The jsonfb package (versions 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.0-beta.1, 1.1.0-beta.2, and 1.1.1) masquerades as a JSON.parse bigint helper but contains heavily obfuscated code that loads remote JavaScript payloads via HTTP GET requests. These payloads are base64-decoded and executed inside a sandbox environment with access to critical Node.js modules such as fs, os, path, child_process, http, and require. The package also sends runtime state and sandbox output back to attacker-controlled servers using HMAC-MD5 signed POST requests. The obfuscation, author impersonation, typosquatting, and remote code execution with data exfiltration combine to form a fully functional command-and-control dropper.

Any system with this package installed or running is considered fully compromised. The attacker gains remote code execution capabilities and can exfiltrate sensitive data. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is available. Immediate removal of the jsonfb package versions 1.0.7 through 1.1.1 is strongly recommended. All secrets and credentials on affected systems should be rotated from a different, secure machine. Due to the high likelihood of full system compromise, consider rebuilding the affected environment from a known good state.