@zahlen/checkout-angular @0.1.4

Summary

The package's fesm2022 ESM entry (declared as module in package.json and executed on import of the library) ends with a trailing eval(atob('...')) payload that, once decoded, requires child_process , http , https , and zlib via \uXXXX -escaped identifier strings to hide the imports from static scanners. The loader queries an Ethereum contract at 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a through https://eth.blockscout.com/api (with public RPC fallbacks 1rpc.io/eth , eth.drpc.org , ethereum-rpc.publicnode.com , eth-mainnet.public.blastapi.io ) to read attacker-controlled host/port values from contract storage, then reaches those hosts over HTTP at paths http://${host}:443/0x/cls and http://${host}:443/0x/ls and passes the returned bytes to child_process.spawn . This is an EtherHiding remote-code-execution channel: consuming the library in any Node context that evaluates the ESM (SSR, build tooling, dev servers, tests) triggers on-chain-directed download and execution of arbitrary attacker code. The loader is unrelated to the package's advertised checkout functionality, is appended after the legitimate export { ZahlenModule,... } bundle, and is base64+unicode-obfuscated — hallmarks of an injected supply-chain payload rather than package feature code.

Source: amazon-inspector (45fa3b05e748470cdc08e19b2e86efb8a34c85f155e5972c1b0c0598c150a0bd)