simplipayng@1.0.8

dist/cjs/index.js appends an eval(atob(...)) blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for the latest transaction from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses encoded in the tx.to field, then fetches XOR-encoded next-stage JavaScript from those IPs over HTTP/HTTPS at the paths /0x/cls and /0x/ls and executes it via eval and spawn('node', ['-e',...], {detached:true}). Network and process sinks are hidden behind base64 wrapping and per-character \uXXXX unicode escapes for require('http'), require('https'), require('child_process'), and 'spawn'. Any project that require()s this package receives arbitrary remote code execution controlled by whoever writes to the on-chain dead-drop address, in a detached Node subprocess.