The jsonfb npm package versions 1.0.7 through 1.1.1 contain malicious code that impersonates a JSON parsing helper but actually executes obfuscated remote code. It fetches base64-encoded JavaScript from remote URLs and executes it within a sandbox that exposes sensitive Node.js modules. The package also exfiltrates runtime data via HMAC-MD5 signed POST requests to attacker-controlled endpoints. This behavior effectively creates a live command-and-control dropper, compromising any system that installs or runs it.