The @zahlen/checkout-react npm package version 0.1.1 contains a top-level malicious code block that runs on every import or require. This block uses unicode-escape sequences to obfuscate the import of Node.js built-in modules including child_process, http, https, zlib, and url. It resolves a C2 server by querying Ethereum blockchain state via a specific contract address and a public ETH RPC fallback list. The package then polls endpoints on the resolved C2 host and executes received commands using child_process.spawn, enabling arbitrary command execution on the host system. The malicious code also stores references to require and module globally to facilitate loading additional Node.js modules dynamically. The visible React checkout functionality is a decoy, while the on-chain C2 resolution mechanism allows the attacker to rotate infrastructure without republishing the package.

This malicious package allows remote attackers to execute arbitrary commands on any system that installs or imports @zahlen/checkout-react version 0.1.1. This includes developer machines and continuous integration environments, potentially leading to full system compromise, data theft, or further malware deployment. The use of blockchain-based C2 resolution provides resilience and stealth to the attacker’s infrastructure.

No official patch or remediation is currently documented for this package version. Users should immediately remove and avoid installing or importing @zahlen/checkout-react version 0.1.1. Audit dependency trees for this package and replace it with trusted alternatives. Monitor for any signs of compromise on affected systems. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates. Given the malicious nature, removal and avoidance is the primary mitigation.