@voxepay/checkout
Modern payment checkout modal for VoxePay - beautiful, fast, and secure
This report shows the evidence for @voxepay/checkout@0.5.19. 8 of 9 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains a concrete, import-time remote-code-execution chain with stealthy second-stage retrieval and detached execution. The legitimate payment SDK source does not account for this appended artifact payload.
Decision evidence
public snapshot- dist/index.cjs.js appends obfuscated eval(atob(...)) after exports.
- Decoded payload runs immediately on module import and requires child_process.
- Payload queries Ethereum RPC/block explorers to derive a command host.
- It fetches XOR-obfuscated second-stage code, evals it, and spawns detached node processes.
- The same appended loader is present in dist/index.esm.js.
- src/ contains a conventional browser payment SDK and no matching loader.
- package.json has only prepublishOnly; no install lifecycle hook.
Source & flagged code
1 flagged · loading sourcePackage source references a known benign dynamic code generation pattern.
dist/index.cjs.jsView on unpkg · L2270Findings
Affected versions and remediation
This report applies to @voxepay/checkout@0.5.19.
The versions list below shows the verdict for each recorded version.
- Avoid installing @voxepay/checkout@0.5.19. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.