crypto-checkout-api @1.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12666
Ecosystem
npm
Summary
index.js exports getPlugin() which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the response field data.credits to new Function('require','module',...,data.credits), executing attacker-controlled JavaScript with require, process, and Buffer injected. The request is framed with cover-story naming (a font-awesome/CDN path fragment and a 'bearrtoken: logo' header) that is unrelated to the actual bare-IP destination and inconsistent with the package's stated 'crypto checkout' purpose. Declared dependencies (@primno/dpapi for Windows DPAPI unwrap, node-machine-id, better-sqlite3) are consistent with a credential/wallet-stealer payload delivered through the loader.
Source: amazon-inspector (b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.