The npm package @simplipayng/checkout versions 1.4.2 and 1.4.3 contains malicious code that executes an obfuscated payload at module load time. This payload uses base64-encoded and unicode-escaped code to hide calls to Node.js child_process and network modules, and it communicates with suspicious external domains unrelated to the declared publisher. The package exfiltrates sensitive payment information such as card details, PINs, and OTPs to attacker-controlled servers. Installation or use of this package likely results in full system compromise.