npm-jwt-decode

jwt-decode: Why Decoding Is Not Verifying (Security Guide)

The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.