MalwarePublished 6 Aug 2026

@voxepay/checkout (npm) · Malicious Code

Affects @voxepay/checkoutSource GCVE Database

Malicious package : remove @voxepay/checkout and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 04:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13389

What to do

Remove @voxepay/checkout from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@voxepay/checkout	Affected 0.5.12 – 0.5.19 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @voxepay/checkout versions 0.5.12 through 0.5.19 contain malicious code that can fully compromise any computer on which it is installed. Although one source found no suspicious behavior in the package contents, another authoritative source classifies the package as fully compromising the host, recommending immediate removal and secret rotation. The malicious package may grant attackers full control, and removing it does not guarantee complete remediation.

Impact

Any computer with the affected versions of @voxepay/checkout installed should be considered fully compromised. Attackers may have obtained full control over the system, including access to all secrets and keys stored on it. Removing the package alone may not remove all malicious software introduced, necessitating secret rotation and further remediation steps.

Defensive guidance

Remove the @voxepay/checkout package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted device. Because full system compromise is possible, further investigation and remediation beyond package removal are recommended.

Summary

The npm package @voxepay/checkout in versions 0.5.12, 0.5.13, 0.5.14, 0.5.15, 0.5.16, 0.5.17, 0.5.18, and 0.5.19 has been identified as malicious by the GHSA-malware source (GHSA-qgfh-mjq8-m7wx). This package is considered fully compromising any system where it is installed, potentially exposing all stored secrets and keys. While Amazon Inspector did not detect suspicious behaviors in the package, the malware advisory warns that the package should be removed immediately and secrets rotated from a different machine, as full control may have been given to attackers.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 04:18 UTC

Technical details

References

Community reviews