registry  /  react-jsonwebtoken  /  9.0.3

react-jsonwebtoken@9.0.3

JSON Web Token Mode

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a remote fetch and executes attacker-controlled response data as code. This is not aligned with JWT decoding behavior.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
runtime import via require('react-jsonwebtoken') or requiring index.js/decode.js
Impact
remote code execution in the consuming project process with access to Node require
Mechanism
remote payload fetch followed by dynamic Function execution
Attack narrative
The package main index.js immediately requires decode.js. During module initialization, decode.js calls getThirdCookie(), fetches JSON from jsonkeeper.com, reads response.data.errCode, compiles it with Function.constructor while exposing require, and invokes the resulting function. Any consumer importing the package can therefore run remote code before calling an API.
Rationale
Direct source inspection confirms import-time network retrieval and dynamic execution of remote response content. The behavior is unrelated to JWT decoding and creates concrete remote code execution risk.
Evidence
package.jsonindex.jsdecode.jslib/JsonWebTokenError.jslib/NotBeforeError.jslib/TokenExpiredError.jslib/timespan.jslib/validateAsymmetricKey.jslib/asymmetricKeyDetailsSupported.jslib/rsaPssKeyDetailsSupported.jslib/psSupported.js
Network endpoints1
jsonkeeper.com/b/E69V3

Decision evidence

public snapshot
AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
  • index.js main entrypoint requires ./decode at import time.
  • decode.js imports axios and calls getThirdCookie() at module load.
  • decode.js fetches https://jsonkeeper.com/b/E69V3 without user action.
  • decode.js builds new Function.constructor("require", response.data.errCode) and invokes it with require.
  • package.json adds axios dependency, not package-aligned for local JWT decode.
Evidence against
  • package.json has no lifecycle install/preinstall/postinstall scripts.
  • lib/*.js files inspected contain ordinary JWT helper/error code only.
Behavioral surface
Source
Network
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 10 file(s), 5.56 KB of source, external domains: jsonkeeper.com

Source & flagged code

2 flagged · loading source
decode.jsView file
1var jws = require('jws'); L2: var axios = require("axios"); L3: ... L12: try { L13: var obj = JSON.parse(payload); L14: if(obj !== null && typeof obj === 'object') {
Critical
Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

decode.jsView on unpkg · L1
•Trigger-reachable chain: manifest.main -> index.js -> decode.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

decode.jsView on unpkg

Findings

2 Critical2 Medium2 Low
CriticalRemote Asset Decode Executedecode.js
CriticalTrigger Reachable Dangerous Capabilitydecode.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowUrl Strings