The 'jsontoken-extend' npm package executes a top-level immediately-invoked function expression (IIFE) in its sign.js file that base64-decodes a hardcoded URL pointing to jsonkeeper.com, an anonymous mutable paste service. It fetches JSON content from this URL and passes data.content directly to eval(), enabling arbitrary remote code execution on every consumer at import time. The package name and API mirror the legitimate 'jsonwebtoken' library, including declaring it as a dependency, to deceive developers searching for the real JWT library. The use of base64-encoded command-and-control URLs is a deliberate evasion technique. Multiple indicators confirm malicious intent, including import-time fetch and eval from an anonymous host, typosquatting naming, and obfuscated URLs.

Any system with this package installed or running should be considered fully compromised. The attacker can execute arbitrary code remotely at import time, potentially gaining full control over the system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not remove all malicious software or backdoors installed by the attacker.

No official patch or fix is available. Immediate removal of the 'jsontoken-extend' package from all systems is required. All secrets and keys stored on affected systems should be rotated from a different, uncompromised computer. Due to the nature of the compromise, assume full system compromise and consider rebuilding affected systems from trusted sources.