jsonwebtoken
npmjsonwebtokenjsonwebtoken is the most widely used Node.js library for creating and verifying JSON Web Tokens. It signs tokens using HMAC secrets or RSA/EC private keys and verifies them with the corresponding secret or public key. Most Node.js REST APIs use this package to issue and validate session tokens.
Checking jsonwebtoken
jsonwebtoken 9.0.2 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=jsonwebtoken&version=9.0.2" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "jsonwebtoken",
"version": "9.0.2",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
jsonwebtoken receives HMAC secrets or RSA/EC private keys used to mint session tokens. Stealing the signing material lets an attacker forge valid JWTs for any subject the app accepts.
Attestd monitors jsonwebtoken using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.