The jsontoken-extend npm package executes a top-level immediately-invoked function expression (IIFE) in sign.js that base64-decodes a hardcoded URL pointing to jsonkeeper.com, an anonymous mutable paste service. It fetches JSON data from this URL and passes the content directly to eval(), allowing arbitrary remote code execution on any system importing the package. The package mimics the API and name of the popular jsonwebtoken library and even declares jsonwebtoken as a dependency to appear legitimate, constituting a typosquatting attack. The use of base64-encoded URLs is intended to evade static analysis. Multiple payload URLs are staged, indicating prepared malicious payloads. This behavior effectively compromises any system with the package installed or running.

Any system that installs or runs jsontoken-extend is fully compromised due to arbitrary remote code execution at import time. Attackers can execute any code, potentially stealing secrets, keys, or other sensitive data. The compromise is severe enough that all secrets and keys on the affected system should be rotated from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently available. The package should be immediately removed from all systems. All secrets and keys stored on affected machines must be rotated from a secure environment. Due to the nature of the compromise, affected systems should be considered fully compromised and undergo thorough investigation and remediation. Avoid installing packages with names similar to popular libraries without verifying authenticity.