Malicious code in jwt-path (npm)

The npm package jwt-path at version 3.1.3 has been identified as containing malicious code. This is cataloged under the identifier MAL-2026-7306 and GHSA-22vc-x592-f4mf. There is no detailed technical description of the malicious behavior or exploitation method. No patch or remediation information is available from the provided data.

Users of jwt-path version 3.1.3 may be exposed to malicious code execution or supply chain compromise risks inherent in installing a malicious package. No specific impact details or exploitation in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Until a fix or removal guidance is provided, users should avoid using version 3.1.3 of jwt-path and consider removing or replacing the package.