The @simplipayng/checkout npm package versions 1.4.2 and 1.4.3 include a malicious payload embedded in the main distributed file (dist/index.js) that executes immediately upon requiring the module. The payload is double-obfuscated using base64 encoding and unicode escapes to conceal usage of Node.js modules like child_process, http, https, zlib, and url. It iterates over public Ethereum JSON-RPC endpoints and constructs network requests to attacker-controlled domains (https://devpay.voxepay.app and https://pay.voxepay.app) that do not match the declared publisher's domain. This behavior is inconsistent with the advertised React card-checkout functionality and indicates a dropper or backdoor. The package exfiltrates sensitive payment information entered by users. Removal of the package does not guarantee full remediation due to potential system compromise.

Any system with this package installed or running should be considered fully compromised. Sensitive information such as payment card details, PINs, and OTPs may have been exfiltrated to attacker-controlled servers. The attacker may have gained full control over the affected system, risking exposure of all stored secrets and keys. Immediate secret rotation from a separate secure system is required. The presence of this package poses a severe risk to confidentiality and system integrity.

Remove the @simplipayng/checkout package versions 1.4.2 and 1.4.3 immediately from all systems. Consider all affected systems fully compromised and perform secret and key rotation from a different, trusted environment. Because the package executes a backdoor payload, removal alone may not fully remediate the compromise; conduct a thorough incident response and forensic analysis. No official patch or fix is available; avoid using this package entirely.