jsonapptoken

{"modified":"2026-03-19T12:23:21Z","published":"2025-12-23T08:17:50Z","schema_version":"1.7.4","id":"MAL-2025-192808","aliases":["SNYK-JS-JSONAPPTOKEN-14152265"],"summary":"Malicious code in jsonapptoken (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (40b5e4f69790478de9df8bd2927408bf4ce006c71674885ae54dda73c140d8bb)\nThe package jsonapptoken was found to contain malicious code.\n","affected":[{"package":{"ecosystem":"npm","name":"jsonapptoken","purl":"pkg:npm/jsonapptoken"},"versions":["2.3.8"]}],"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-JSONAPPTOKEN-14152265"},{"type":"ARTICLE","url":"https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"ReversingLabs","type":"FINDER","contact":["https://www.reversinglabs.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","sha256":"124108675dd958b7dfed21505eaa7ceef8b50bb19ca1bac59f6b42b4e6633492","import_time":"2025-12-24T10:07:23.808819533Z","id":"RLMA-2025-06374","modified_time":"2025-12-23T08:17:50Z","versions":["2.3.8"]},{"source":"amazon-inspector","sha256":"40b5e4f69790478de9df8bd2927408bf4ce006c71674885ae54dda73c140d8bb","import_time":"2026-01-02T21:35:49.579118503Z","modified_time":"2026-01-02T21:29:26Z","versions":["2.3.8"]},{"source":"reversing-labs","sha256":"dbbd1ae617522a1fe35503188626f9e4466aa53468e0a350b745ba62f0278585","import_time":"2026-03-19T12:20:54.958942402Z","id":"RLUA-2026-01371","modified_time":"2026-03-18T12:55:57Z"}]}}