The simplipayng npm package version 1.0.8 includes a malicious payload embedded in dist/cjs/index.js. This payload decodes a base64-encoded string that, when executed, queries public Ethereum RPC endpoints for the latest transaction from a hardcoded Ethereum address (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a). It extracts two IPv4 addresses encoded in the transaction's 'to' field, then fetches XOR-encoded JavaScript from these IPs at specific paths (/0x/cls and /0x/ls). The fetched code is executed via eval and a detached Node.js subprocess using child_process.spawn. The code uses heavy obfuscation techniques, including base64 wrapping and Unicode escapes, to hide network and process operations. This design enables arbitrary remote code execution controlled by whoever can write transactions to the specified Ethereum address, effectively creating a blockchain-based dead-drop for malicious payloads.

Any software project that includes simplipayng version 1.0.8 as a dependency is vulnerable to arbitrary remote code execution. An attacker controlling the Ethereum address can deliver and execute arbitrary JavaScript code on affected systems, potentially leading to full system compromise, data theft, or further malware deployment. This is a severe supply chain compromise risk.

No official patch or remediation is currently documented. Users should immediately remove or replace simplipayng version 1.0.8 from their dependencies. Avoid using this package until a trusted, clean version is released. Monitor dependency sources carefully to prevent inclusion of malicious packages.