The npm package @voxepay/checkout in versions 0.5.12, 0.5.13, 0.5.14, 0.5.15, 0.5.16, 0.5.17, 0.5.18, and 0.5.19 has been identified as malicious by the GHSA-malware source (GHSA-qgfh-mjq8-m7wx). This package is considered fully compromising any system where it is installed, potentially exposing all stored secrets and keys. While Amazon Inspector did not detect suspicious behaviors in the package, the malware advisory warns that the package should be removed immediately and secrets rotated from a different machine, as full control may have been given to attackers. No patch or fixed version is indicated.

Any computer with the affected versions of @voxepay/checkout installed should be considered fully compromised. Attackers may have obtained full control over the system, including access to all secrets and keys stored on it. Removing the package alone may not remove all malicious software introduced, necessitating secret rotation and further remediation steps.

Remove the @voxepay/checkout package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted device. Because full system compromise is possible, further investigation and remediation beyond package removal are recommended. No official patch or fixed version is currently available; monitor vendor advisories for updates.