@simplipayng/checkout (npm) · Malicious Code
Affects @simplipayng/checkoutSource GCVE Database
Malicious package : remove @simplipayng/checkout and rotate any secrets on hosts that installed it.
Data as of 6 Aug 2026, 18:41 UTC
Malicious package
Published to npm · OSV MAL-2026-13388
What to do
Remove @simplipayng/checkout from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@simplipayng/checkout | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @simplipayng/checkout versions 1.4.2 and 1.4.3 contains malicious code that executes an obfuscated payload at module load time. This payload uses base64-encoded and unicode-escaped code to hide calls to Node.js child_process and network modules, and it communicates with suspicious external domains unrelated to the declared publisher. The package exfiltrates sensitive payment information such as card details, PINs, and OTPs to attacker-controlled servers. Installation or use of this package likely results in full system compromise.