@simplipayng/checkout @1.4.3

Summary

The bundled main (dist/index.js) executes an eval(atob(...)) blob at module top level, so any Node-side require() of the package (SSR, tests, Next.js server rendering) runs it. The decoded payload uses unicode-escaped identifiers to hide require("child_process") + spawn, require("http"), require("https"), require("zlib"), and require("url"); iterates a list of public Ethereum JSON-RPC endpoints; embeds a unicode-escaped Ethereum address literal (0xa322...Ef1a); and constructs URLs of the form http://<host>:443/0x/cls and http://<host>:443/0x/ls. None of this is consistent with the advertised React card-checkout component. The package is also published as @simplipayng/checkout with homepage simplipay.ng, but the axios client is hardcoded to https://devpay.voxepay.app and https://pay.voxepay.app, so card details, PINs and OTPs entered into the checkout flow are POSTed to a domain that does not match the declared publisher. The double obfuscation (outer base64+eval, inner \uXXXX escapes on every sensitive identifier and URL) combined with child_process + network primitives inside a UI library is a dropper/backdoor shape, not a build artifact.

Source: amazon-inspector (00ead1207956df050d2746ae899d5ea9132fbc4c35684f9e992599c5ef10259c)