crypto-checkout-api@1.0.0

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Consumer invokes the default export getPlugin().

Remote operator can run arbitrary Node.js code in the consuming process.

Hard-coded remote payload download followed by Function-based execution.

At runtime, getPlugin() requests a hard-coded IP endpoint with its default token. It reads data.credits from the JSON response, compiles it with new Function, and invokes it with require, process, global, and Buffer. The endpoint operator therefore controls arbitrary code executed in the caller's Node process.

The package is an explicit staged remote-code loader, not a checkout or analytics implementation. Lack of install hooks limits automatic activation but does not remove the concrete RCE capability when its export is used.