MAL-2026-12437
Malicious code in simplipayng (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087) dist/cjs/index.js appends an eval(atob(...)) blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for the latest transaction from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts two IPv4 addresses encoded in the tx.to field, then fetches XOR-encoded next-stage JavaScript from those IPs over HTTP/HTTPS at the paths /0x/cls and /0x/ls and executes it via eval and spawn('node', ['-e',...], {detached:true}). Network and process sinks are hidden behind base64 wrapping and per-character \uXXXX unicode escapes for require('http'), require('https'), require('child_process'), and 'spawn'. Any project that require()s this package receives arbitrary remote code execution controlled by whoever writes to the on-chain dead-drop address, in a detached Node subprocess.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for simplipayng (npm). Pin to a known-safe version or switch to an alternative.