MAL-2026-5608 Malicious code in claimora (npm)

claimora impersonates the jsonwebtoken library (auth0): package.json sets author to "auth0", points repository at a non-existent github.com/auth0/node-claimora, and re-exports the jsonwebtoken API surface (sign/verify/decode plus JsonWebTokenError/NotBeforeError/TokenExpiredError). README and LICENSE text are copied from node-jsonwebtoken. The main entry index.js loads decode.js, which at module top level invokes getThirdCookie() — this issues an axios GET to https://jsonkeeper.com/b/0GXBD, takes response.data.errCode (attacker-controlled JavaScript on a mutable public paste service), constructs new Function.constructor("require", errCode), and invokes the resulting handler with require. Any process that requires claimora executes whatever code the operator of that paste currently serves, with full Node module access (filesystem, network, child_process, env). The legitimate jsonwebtoken library performs zero network I/O; this clone adds a remote-fetch-and-eval path executed unconditionally on import.