- 17 malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were found on npm and PyPI.
- The fake SDKs return fake success responses while stealing API keys, tokens, and passwords to an AWS-hosted C2 server.
- Malware includes basic anti-analysis checks, stopping execution in virtualized or low-resource environments.
- Socket recommends rotating all secrets, auditing CI logs, and blocking the package names at the registry proxy level.
Developers working with payment platforms like Paysafe, Skrill, and Neteller have become the latest targets of a sophisticated supply-chain attack. Cybersecurity firm Socket uncovered 17 malicious packages published on the Node Package Manager (npm) and the Python Package Index (PyPI) that masquerade as official SDKs but are designed to steal sensitive credentials and access tokens.
These fake libraries were released nearly simultaneously across both ecosystems, making detection harder for teams that only monitor one registry. The threat actor behind the campaign appears technically adept, with the ability to pivot between platforms and evade basic analysis environments.
Coordinated Attack Across Two Registries
According to Socket’s report, the attacker published 13 npm packages and 4 PyPI packages in a short timeframe. The npm packages each had four malicious versions (1.0.0 through 1.0.3), while the PyPI ones were released as version 1.0.0. The affected packages include names like paysafe-checkout, paysafe-vault, paysafe-api, paysafe-node, paysafe-payments, paysafe-sdk, paysafe-kyc, skrill, skrill-sdk, skrill-payments, and neteller, among others. All of them pretend to be legitimate payment SDKs, exposing the expected APIs but never actually communicating with Paysafe’s backend. Instead, they return fake success responses while secretly harvesting data.
What the Malware Steals
The embedded malicious code searches compromised environments for Paysafe API keys, AWS access keys, GitHub tokens, npm tokens, passwords, hostnames, usernames, and API usage metadata. On npm, the data theft routine only activates when a Paysafe API key is present and the fake SDK is called. In contrast, the PyPI packages automatically execute the credential-stealing functionality upon initialization, without requiring any specific key. All exfiltrated data is sent to a command-and-control server hosted on Amazon Web Services (AWS).
Anti-Analysis Tricks and Attacker Profile
The malware includes some basic anti-analysis features. It stops execution if it detects fewer than two CPU cores or if the hostname or username contains terms like sandbox, analyzer, cuckoo, virus, malware, vmware, or vbox. This makes it harder for security researchers to analyze the code in virtualized environments. Socket’s researchers noted that the attacker is sufficiently technical and may return in a more organized way, especially given their ability to target both npm and PyPI simultaneously. The C2 hostname was hidden behind three decoding steps, and the resolved ngrok IP had previously been used for infostealers like NjRAT, suggesting shared criminal infrastructure.
Recommendations for Developers
Socket advises anyone who installed or executed any of the listed packages to immediately rotate all secrets on the affected machine, especially environment variables matching patterns like KEY, SECRET, TOKEN, PASS, AUTH, or API. They also recommend searching dependency trees for the campaign package names and blocking them at the registry proxy level. Additionally, teams should audit CI/CD logs for PAYSAFE_API_KEY usage combined with any of the malicious package names, and look for outbound HTTPS connections to .ngrok-free.dev domains, which are unusual for legitimate payment SDKs.
The discovery underscores the growing risk of supply-chain attacks targeting open-source ecosystems, and developers are urged to verify package authenticity and rotate any potentially compromised secrets without delay.
