MAL-2026-5608

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claimora/MAL-2026-5608.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5608
Published
2026-06-11T07:28:44Z
Modified
2026-06-11T08:01:31Z
Summary
Malicious code in claimora (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1b785b842f24aeae0e20157784b17a8bff7003e72575ac9a3aa9cbeb550a5c92)

claimora impersonates the jsonwebtoken library (auth0): package.json sets author to "auth0", points repository at a non-existent github.com/auth0/node-claimora, and re-exports the jsonwebtoken API surface (sign/verify/decode plus JsonWebTokenError/NotBeforeError/TokenExpiredError). README and LICENSE text are copied from node-jsonwebtoken. The main entry index.js loads decode.js, which at module top level invokes getThirdCookie() — this issues an axios GET to https://jsonkeeper.com/b/0GXBD, takes response.data.errCode (attacker-controlled JavaScript on a mutable public paste service), constructs new Function.constructor("require", errCode), and invokes the resulting handler with require. Any process that requires claimora executes whatever code the operator of that paste currently serves, with full Node module access (filesystem, network, child_process, env). The legitimate jsonwebtoken library performs zero network I/O; this clone adds a remote-fetch-and-eval path executed unconditionally on import.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005704",
            "import_time": "2026-06-11T07:49:42.894614277Z",
            "modified_time": "2026-06-11T07:28:44Z",
            "sha256": "1b785b842f24aeae0e20157784b17a8bff7003e72575ac9a3aa9cbeb550a5c92",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-005705",
            "import_time": "2026-06-11T07:49:43.055028537Z",
            "modified_time": "2026-06-11T07:28:45Z",
            "sha256": "5072f0c8720be41c60a0246459f7cde79dd300af7aa0b04e7223836a99c201a7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / claimora

Package

Name
claimora
View open source insights on deps.dev
Purl
pkg:npm/claimora

Affected ranges

Affected versions

1.*
1.0.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "jsonkeeper.com"
    ],
    "evidence_files": [
        {
            "path": "decode.js",
            "sha256": "7d1e3296ce79573764b4348ff89d507245c7b7a2b28cdf27180fbba2f6218d67",
            "tlsh": "da21ce8c59eeb1144ba330e0c61f94223228f203358ecac0775c83d5afa5928f973bd5"
        },
        {
            "path": "package.json",
            "sha256": "0028c074e57a653f2038f72d61d3bee29c62ac2b2778d996d58db5532d8777ce",
            "tlsh": "fd216b01ce28cda316dd62e65d5904c36a214c478d84bc0d73ea535c4f6d53f29fea6c"
        }
    ],
    "package_integrity": [
        {
            "filename": "claimora-1.0.4.tgz",
            "hashes": {
                "sha1": "aea14b931757cc1d232dd16fd8a8b1536aa19fd3",
                "sha512_sri": "sha512-r88CZkd1EpG+EVpU4FQjwkE23LYJAWRXyQnsbcA61IaB1oLWSRTiacvz5gWVgtGS4PJPH7e96sp7iHwejHUSAg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/claimora/MAL-2026-5608.json"