Which versions of @simplipayng/checkout are malicious?

The following npm versions of @simplipayng/checkout are flagged malicious: 1.4.2, 1.4.3. Treat any of these as compromised.

How do I remediate @simplipayng/checkout if I installed it?

@simplipayng/checkout establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed @simplipayng/checkout — how do I know if it already compromised me?

If @simplipayng/checkout was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is @simplipayng/checkout part of a known attack campaign?

Yes — @simplipayng/checkout is associated with the GHSA-cvhm-4vf7-gq9p, IN-MAL-2026-016002, IN-MAL-2026-016004 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find @simplipayng/checkout across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @simplipayng/checkout (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @simplipayng/checkout across your stack and pipelines.

Malicious package

@simplipayng/checkoutnpm

@simplipayng/checkout is a confirmed malicious npm package (MAL-2026-13388) that opens a backdoor for remote access (malicious versions 1.4.2, 1.4.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @simplipayng/checkout (npm)

MAL-2026-13388

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall @simplipayng/checkout

What this malware does

The bundled main (dist/index.js) executes an eval(atob(...)) blob at module top level, so any Node-side require() of the package (SSR, tests, Next.js server rendering) runs it. The decoded payload uses unicode-escaped identifiers to hide require("child_process") + spawn, require("http"), require("https"), require("zlib"), and require("url"); iterates a list of public Ethereum JSON-RPC endpoints; embeds a unicode-escaped Ethereum address literal (0xa322...Ef1a); and constructs URLs of the form http://<host>:443/0x/cls and http://<host>:443/0x/ls. None of this is consistent with the advertised React card-checkout component. The package is also published as @simplipayng/checkout with homepage simplipay.ng, but the axios client is hardcoded to https://devpay.voxepay.app and https://pay.voxepay.app, so card details, PINs and OTPs entered into the checkout flow are POSTed to a domain that does not match the declared publisher. The double obfuscation (outer base64+eval, inner \uXXXX escapes on every sensitive identifier and URL) combined with child_process + network primitives inside a UI library is a dropper/backdoor shape, not a build artifact.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

2 flagged

1.4.21.4.3

Indicators of compromise (SHA-256)

fcc2f73256242823aac23ffe7141dae7b47503116e3c9d1b44d9d9d4b3574a83

00ead1207956df050d2746ae899d5ea9132fbc4c35684f9e992599c5ef10259c

1add94def4c93467fa102ac79518ccd972d4f28d0dbb99824b139705dd8851e9

Detection & response playbook

Backdoor / remote access

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @simplipayng/checkout (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @simplipayng/checkout across your stack and pipelines.
If you installed it — respond
@simplipayng/checkout establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If @simplipayng/checkout was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @simplipayng/checkout before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. @simplipayng/checkout on npm has been identified as a malicious package (versions 1.4.2, 1.4.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

GHSA-cvhm-4vf7-gq9pIN-MAL-2026-016002IN-MAL-2026-016004

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks @simplipayng/checkout-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database