The @zahlen/checkout-angular npm package version 0.1.4 includes a supply-chain injected payload appended after the legitimate module exports. The payload is obfuscated using base64 and unicode escapes and uses eval to execute. It dynamically requires Node.js modules such as child_process, http, https, and zlib using escaped identifiers to avoid detection by static scanners. The malicious code queries an Ethereum contract at address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a via the Blockscout API and several public RPC endpoints to retrieve attacker-controlled host and port values. It then connects to these hosts over HTTP on port 443 and downloads data from specific paths, which it executes using child_process.spawn. This behavior constitutes a remote code execution channel controlled via on-chain data, representing a severe supply-chain compromise risk.

Any Node.js environment that imports the ESM module of @zahlen/checkout-angular version 0.1.4 will execute attacker-controlled code, leading to remote code execution. This can result in full system compromise, data theft, or further malware deployment. The attack leverages blockchain-based command and control, making detection and mitigation more complex. This affects build tooling, server-side rendering, development servers, and tests that import the package.

No official patch or remediation is currently documented. Users should immediately stop using version 0.1.4 of @zahlen/checkout-angular. Audit dependencies for this package and remove or replace it. Monitor for updates from the package maintainers or npm advisories for any official fixes. Until a fix is available, avoid importing this package in any Node.js context.