claimora

claimora impersonates the jsonwebtoken library (auth0): package.json sets author to "auth0", points repository at a non-existent github.com/auth0/node-claimora, and re-exports the jsonwebtoken API surface (sign/verify/decode plus JsonWebTokenError/NotBeforeError/TokenExpiredError). README and LICENSE text are copied from node-jsonwebtoken. The main entry index.js loads decode.js, which at module top level invokes getThirdCookie() — this issues an axios GET to https://jsonkeeper.com/b/0GXBD, takes response.data.errCode (attacker-controlled JavaScript on a mutable public paste service), constructs `new Function.constructor("require", errCode)`, and invokes the resulting handler with `require`. Any process that requires claimora executes whatever code the operator of that paste currently serves, with full Node module access (filesystem, network, child_process, env). The legitimate jsonwebtoken library performs zero network I/O; this clone adds a remote-fetch-and-eval path executed unconditionally on import.