The jsonfb package is a typosquatting malicious npm package masquerading as a JSON.parse bigint helper. It uses extensive obfuscation techniques to hide its true functionality, which includes downloading base64-encoded JavaScript from remote URLs and executing it within a sandbox that exposes sensitive Node.js modules such as fs, os, child_process, and require. The package automatically starts a polling loop to fetch and run this remote code when in production or when a specific environment variable is set. Additionally, it sends signed HMAC-MD5 POST requests containing runtime state and sandbox output back to attacker-controlled endpoints. The package impersonates the legitimate json-bigint maintainer and repository to deceive users. This behavior constitutes a live command-and-control (C2) dropper, effectively granting attackers full control over affected systems.

Systems with any of the affected jsonfb versions installed are fully compromised. The malicious package enables remote code execution with broad system privileges, allowing attackers to run arbitrary code, access filesystem and OS resources, spawn processes, and exfiltrate sensitive data. All secrets and keys stored on compromised systems should be considered exposed and must be rotated. Removal of the package alone may not eliminate all malicious artifacts or backdoors installed by the attacker.

No official patch or fix is available for this malicious package. Immediate removal of the jsonfb package from all systems is required. All secrets and credentials stored on affected systems should be rotated from a secure, uncompromised environment. Due to the high likelihood of full system compromise, a thorough incident response and system rebuild is recommended to ensure complete eradication of the attacker presence.