The npm package @voxepay/checkout versions 0.5.12 through 0.5.19 contain malicious code that can fully compromise any computer on which it is installed. Although one source found no suspicious behavior in the package contents, another authoritative source classifies the package as fully compromising the host, recommending immediate removal and secret rotation. The malicious package may grant attackers full control, and removing it does not guarantee complete remediation.