@zahlen/checkout-angular

The package's fesm2022 ESM entry (declared as `module` in package.json and executed on `import` of the library) ends with a trailing `eval(atob('...'))` payload that, once decoded, requires `child_process`, `http`, `https`, and `zlib` via `\uXXXX`-escaped identifier strings to hide the imports from static scanners. The loader queries an Ethereum contract at `0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a` through `https://eth.blockscout.com/api` (with public RPC fallbacks `1rpc.io/eth`, `eth.drpc.org`, `ethereum-rpc.publicnode.com`, `eth-mainnet.public.blastapi.io`) to read attacker-controlled host/port values from contract storage, then reaches those hosts over HTTP at paths `http://${host}:443/0x/cls` and `http://${host}:443/0x/ls` and passes the returned bytes to `child_process.spawn`. This is an EtherHiding remote-code-execution channel: consuming the library in any Node context that evaluates the ESM (SSR, build tooling, dev servers, tests) triggers on-chain-directed download and execution of arbitrary attacker code. The loader is unrelated to the package's advertised checkout functionality, is appended after the legitimate `export { ZahlenModule,... }` bundle, and is base64+unicode-obfuscated — hallmarks of an injected supply-chain payload rather than package feature code.