claimora

{"modified":"2026-06-11T07:52:08Z","published":"2026-06-11T07:28:44Z","schema_version":"1.7.4","id":"MAL-2026-5608","summary":"Malicious code in claimora (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b785b842f24aeae0e20157784b17a8bff7003e72575ac9a3aa9cbeb550a5c92)\nclaimora impersonates the jsonwebtoken library (auth0): package.json sets author to \"auth0\", points repository at a non-existent github.com/auth0/node-claimora, and re-exports the jsonwebtoken API surface (sign/verify/decode plus JsonWebTokenError/NotBeforeError/TokenExpiredError). README and LICENSE text are copied from node-jsonwebtoken. The main entry index.js loads decode.js, which at module top level invokes getThirdCookie() — this issues an axios GET to https://jsonkeeper.com/b/0GXBD, takes response.data.errCode (attacker-controlled JavaScript on a mutable public paste service), constructs `new Function.constructor(\"require\", errCode)`, and invokes the resulting handler with `require`. Any process that requires claimora executes whatever code the operator of that paste currently serves, with full Node module access (filesystem, network, child_process, env). The legitimate jsonwebtoken library performs zero network I/O; this clone adds a remote-fetch-and-eval path executed unconditionally on import.\n","affected":[{"package":{"ecosystem":"npm","name":"claimora"},"versions":["1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["jsonkeeper.com"],"evidence_files":[{"path":"decode.js","sha256":"7d1e3296ce79573764b4348ff89d507245c7b7a2b28cdf27180fbba2f6218d67","tlsh":"da21ce8c59eeb1144ba330e0c61f94223228f203358ecac0775c83d5afa5928f973bd5"},{"path":"package.json","sha256":"0028c074e57a653f2038f72d61d3bee29c62ac2b2778d996d58db5532d8777ce","tlsh":"fd216b01ce28cda316dd62e65d5904c36a214c478d84bc0d73ea535c4f6d53f29fea6c"}],"package_integrity":[{"filename":"claimora-1.0.4.tgz","hashes":{"sha1":"aea14b931757cc1d232dd16fd8a8b1536aa19fd3","sha512_sri":"sha512-r88CZkd1EpG+EVpU4FQjwkE23LYJAWRXyQnsbcA61IaB1oLWSRTiacvz5gWVgtGS4PJPH7e96sp7iHwejHUSAg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claimora/v/1.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-005704","import_time":"2026-06-11T07:49:42.894614277Z","modified_time":"2026-06-11T07:28:44Z","sha256":"1b785b842f24aeae0e20157784b17a8bff7003e72575ac9a3aa9cbeb550a5c92","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-005705","import_time":"2026-06-11T07:49:43.055028537Z","modified_time":"2026-06-11T07:28:45Z","sha256":"5072f0c8720be41c60a0246459f7cde79dd300af7aa0b04e7223836a99c201a7","source":"amazon-inspector","versions":["1.0.4"]}]}}