registry / @voxepay/checkout / 0.5.19

@voxepay/checkout@0.5.19

Modern payment checkout modal for VoxePay - beautiful, fast, and secure

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Both published module entrypoints include an import-time, obfuscated remote payload loader not present in src/. It derives a host from blockchain data, retrieves code, evaluates it, and launches detached Node processes.

Static reason

No blocking static signals were detected.

Trigger

Importing or requiring the package's CJS or ESM entrypoint.

Impact

Arbitrary attacker-controlled code can execute in the importing Node process and persist as detached child processes.

Mechanism

Obfuscated blockchain-addressed remote code execution with detached-process launch.

Attack narrative

On import, the appended loader contacts Ethereum RPC/block-explorer services, locates a transaction from a hard-coded address, and interprets transaction bytes as command-host IP addresses. It fetches XOR-obfuscated payloads from those hosts, evaluates one in-process, and starts another with detached node -e execution. This is concealed in built artifacts and absent from reviewed TypeScript source.

Rationale

The package contains a concrete, import-time remote-code-execution chain with stealthy second-stage retrieval and detached execution. The legitimate payment SDK source does not account for this appended artifact payload.

Evidence

package.jsonsrc/api/client.tssrc/components/modal.tssrc/index.tssrc/voxepay.tsdist/index.cjs.jsdist/index.esm.js

Network endpoints5

1rpc.io/eth

No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded attacker-controlled network destinations, no credential or environment scraping, no obfuscated payloads, and no dropper or backdoor patterns. Package contents are consistent with a checkout SDK library. ## Source: ghsa-malware (aeab1a5fee297e8c8176addde126406d5db09b4e0990a5a4b641e6d989375db5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@voxepay/checkout@0.5.19

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code