@simplipayng/checkout@1.4.3

Analysis

The package's bundled dist/index.js and dist/index.esm.js each append a base64-encoded payload that decodes to a remote-code-execution dropper. On load it queries public Ethereum RPC endpoints (rpc[.]ankr[.]com/eth, eth[.]drpc[.]org, ethereum-rpc[.]publicnode[.]com, eth-mainnet[.]public[.]blastapi[.]io) and the eth[.]blockscout[.]com API to read transactions from a hardcoded Ethereum address, extracts an IP address from the transaction data, then spawns detached `node -e` child processes (detached, stdio ignored, windowsHide) that fetch and execute additional remote payloads from that IP over HTTP. Communication with the C2 is XOR-encrypted via an x-payload-b64 header. The C2 endpoint is derived from blockchain transaction data rather than being hardcoded.