MalwarePublished 13 Jul 2026Updated 1 Sep 2026

jsonfb (npm) · Malicious Code

Affects jsonfbSource GCVE Database

Malicious package : remove jsonfb and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 15:02 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10437

What to do

Remove jsonfb from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmjsonfb	Affected 1.0.7 – 1.1.1 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The jsonfb npm package versions 1.0.7 through 1.1.1 contain malicious code that impersonates a JSON parsing helper but actually executes obfuscated remote code. It fetches base64-encoded JavaScript from remote URLs and executes it within a sandbox that exposes sensitive Node.js modules. The package also exfiltrates runtime data via HMAC-MD5 signed POST requests to attacker-controlled endpoints. This behavior effectively creates a live command-and-control dropper, compromising any system that installs or runs it.

Impact

Any system with this package installed or running is considered fully compromised. The attacker gains remote code execution capabilities and can exfiltrate sensitive data. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Defensive guidance

Immediate removal of the jsonfb package versions 1.0.7 through 1.1.1 is strongly recommended. All secrets and credentials on affected systems should be rotated from a different, secure machine. Due to the high likelihood of full system compromise, consider rebuilding the affected environment from a known good state.

Summary

The jsonfb package (versions 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.0-beta.1, 1.1.0-beta.2, and 1.1.1) masquerades as a JSON.parse bigint helper but contains heavily obfuscated code that loads remote JavaScript payloads via HTTP GET requests. These payloads are base64-decoded and executed inside a sandbox environment with access to critical Node.js modules such as fs, os, path, child_process, http, and require. The package also sends runtime state and sandbox output back to attacker-controlled servers using HMAC-MD5 signed POST requests. The obfuscation, author impersonation, typosquatting, and remote code execution with data exfiltration combine to form a fully functional command-and-control dropper.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 15:02 UTC

Technical details

References

Community reviews