{"id":"MAL-2025-192808","summary":"Malicious code in jsonapptoken (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (40b5e4f69790478de9df8bd2927408bf4ce006c71674885ae54dda73c140d8bb)\nThe package jsonapptoken was found to contain malicious code.\n","aliases":["SNYK-JS-JSONAPPTOKEN-14152265"],"modified":"2026-03-19T12:45:14.763051Z","published":"2025-12-23T08:17:50Z","database_specific":{"malicious-packages-origins":[{"sha256":"124108675dd958b7dfed21505eaa7ceef8b50bb19ca1bac59f6b42b4e6633492","source":"reversing-labs","versions":["2.3.8"],"id":"RLMA-2025-06374","import_time":"2025-12-24T10:07:23.808819533Z","modified_time":"2025-12-23T08:17:50Z"},{"modified_time":"2026-01-02T21:29:26Z","sha256":"40b5e4f69790478de9df8bd2927408bf4ce006c71674885ae54dda73c140d8bb","source":"amazon-inspector","versions":["2.3.8"],"import_time":"2026-01-02T21:35:49.579118503Z"},{"source":"reversing-labs","id":"RLUA-2026-01371","import_time":"2026-03-19T12:20:54.958942402Z","modified_time":"2026-03-18T12:55:57Z","sha256":"dbbd1ae617522a1fe35503188626f9e4466aa53468e0a350b745ba62f0278585"}]},"references":[{"type":"ARTICLE","url":"https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-JSONAPPTOKEN-14152265"},{"type":"ARTICLE","url":"https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html"}],"affected":[{"package":{"name":"jsonapptoken","ecosystem":"npm","purl":"pkg:npm/jsonapptoken"},"versions":["2.3.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jsonapptoken/MAL-2025-192808.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}