Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps

This threat campaign involves malicious packages published simultaneously on npm and PyPI that impersonate popular secure payment SDKs through typosquatting. The malware embedded in these packages employs sophisticated evasion techniques such as sandbox detection and multi-layer command-and-control domain obfuscation using XOR encoding. It selectively activates to avoid detection and exfiltrates sensitive environment variables including API keys and authentication tokens to attacker-controlled infrastructure hosted on AWS and accessed via ngrok tunnels. The campaign demonstrates coordination across multiple package ecosystems and operational security measures, indicating an organized financially motivated adversary. No specific affected software versions are identified, as the threat targets developers who may install these malicious packages.

The campaign enables theft of developer credentials, API keys, tokens, and authentication secrets by exfiltrating environment variables from compromised development environments. This can lead to unauthorized access to cloud services and other sensitive resources. The use of typosquatting increases the risk of inadvertent installation by developers expecting legitimate payment SDKs. The advanced evasion techniques reduce the likelihood of early detection, increasing potential exposure duration.

No official patches or fixes are applicable since this is a supply chain campaign involving malicious packages. Developers and organizations should avoid installing packages from untrusted or suspicious sources, verify package names carefully to avoid typosquatting traps, and monitor for unexpected environment variable exfiltration. Use of package signing, dependency scanning tools, and restricting environment variables in build and deployment pipelines can reduce risk. Since this is not a cloud service vulnerability, remediation depends on user vigilance and supply chain security practices.