Supply chain · npm · High

Critical Malicious npm Package: 'checkout-mobile-pay-button' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-18

The npm package 'checkout-mobile-pay-button' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further steps due to potential persistent compromise.

  • Package: npm / checkout-mobile-pay-button
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~28/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'checkout-mobile-pay-button' npm package contains malware. Installation of this package results in the full compromise of the host system, granting an external entity control.

How the attack works

This is a malicious package injection attack where a seemingly benign software component, when integrated into a project, executes unauthorized code. This typically involves the package's installation script or main logic performing actions beyond its stated purpose, such as establishing persistence or exfiltrating data.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any system where 'checkout-mobile-pay-button' was installed directly or as a transitive dependency

Conditions that increase exposure

  • Unpinned dependency versions in package.json allowing for automatic updates to malicious versions
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock) to ensure consistent dependency resolution
  • Use of internal package mirrors that do not vet upstream packages for malicious content

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets and keys (e.g., API tokens, SSH keys, cloud credentials) stored on the compromised computer are exposed and can be stolen.
  • The compromised system could be used as a pivot point for lateral movement within an organization's network.

What to do (defensive)

Detect

  • Scan dependency trees for the presence of 'checkout-mobile-pay-button' in any version.
  • Monitor network traffic for unusual outbound connections from systems that installed this package.
  • Review system logs for unexpected process execution or file modifications on developer workstations or build servers.

Contain

  • Immediately isolate any system identified as having installed 'checkout-mobile-pay-button' from the network.
  • Block 'checkout-mobile-pay-button' from being downloaded from npm registries or internal mirrors.
  • Suspend any CI/CD pipelines that may have pulled or built projects containing this package.

Remediate

  • Consider any system that installed 'checkout-mobile-pay-button' to be fully compromised and initiate incident response protocols.
  • Rotate all secrets and keys (e.g., API keys, passwords, SSH keys) that were stored on or accessible from the compromised system, performing this action from a known clean machine.
  • Remove the 'checkout-mobile-pay-button' package; however, be aware that full system re-imaging or restoration from a clean backup may be necessary to guarantee removal of all malicious components.

Frontier verdict — High

This critical npm package compromise requires immediate isolation, secret rotation, and thorough remediation due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.