Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, delivering credential-stealing malware. These packages expose expected APIs but return fake success responses while exfiltrating sensitive data such as API keys, tokens, and passwords to a command-and-control server. The npm packages require the presence of a Paysafe API key to activate data theft, whereas the PyPI packages activate immediately. Basic anti-analysis techniques are employed to evade detection. Developers using these packages should rotate all secrets and remove the malicious dependencies.
AI Analysis
Technical Summary
A threat actor published at least 17 malicious packages on npm and PyPI mimicking legitimate Paysafe, Skrill, and Neteller payment SDKs. These packages, spanning versions 1.0.0 to 1.0.3 on npm and 1.0.0 on PyPI, expose the expected APIs but do not communicate with the real backend services. Instead, they steal credentials and access tokens including Paysafe API keys, AWS keys, GitHub tokens, npm tokens, and environment metadata, sending this data to a command-and-control server hosted on AWS. The npm packages activate data theft only if a Paysafe API key is detected, while the PyPI packages activate immediately upon initialization. Anti-analysis checks prevent execution in virtualized or low-core environments. The campaign targets developers integrating these SDKs into payment and financial applications. The threat actor's technical sophistication suggests potential future campaigns across ecosystems.
Potential Impact
The malicious packages compromise developer environments by stealing sensitive credentials and tokens used for authentication and API access. This can lead to unauthorized access to payment platforms, cloud services, source code repositories, and other critical infrastructure. The fake SDKs also disrupt normal application behavior by returning fake success responses, potentially masking the attack. The data exfiltration to an AWS-hosted command-and-control server increases the risk of further exploitation and lateral movement within affected organizations.
Mitigation Recommendations
No official patch or fix is available as this is a supply chain malware campaign involving malicious packages. Developers should immediately remove any of the listed malicious packages from their projects and rotate all secrets (API keys, tokens, passwords) on any machine that imported or executed these packages. It is recommended to audit dependency trees for these package names and block them at registry proxy levels. Reviewing CI system logs for usage of PAYSAFE_API_KEY in conjunction with these package names is advised. Vigilance across multiple ecosystems (npm and PyPI) is necessary to detect and prevent similar attacks.
Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
Description
Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, delivering credential-stealing malware. These packages expose expected APIs but return fake success responses while exfiltrating sensitive data such as API keys, tokens, and passwords to a command-and-control server. The npm packages require the presence of a Paysafe API key to activate data theft, whereas the PyPI packages activate immediately. Basic anti-analysis techniques are employed to evade detection. Developers using these packages should rotate all secrets and remove the malicious dependencies.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A threat actor published at least 17 malicious packages on npm and PyPI mimicking legitimate Paysafe, Skrill, and Neteller payment SDKs. These packages, spanning versions 1.0.0 to 1.0.3 on npm and 1.0.0 on PyPI, expose the expected APIs but do not communicate with the real backend services. Instead, they steal credentials and access tokens including Paysafe API keys, AWS keys, GitHub tokens, npm tokens, and environment metadata, sending this data to a command-and-control server hosted on AWS. The npm packages activate data theft only if a Paysafe API key is detected, while the PyPI packages activate immediately upon initialization. Anti-analysis checks prevent execution in virtualized or low-core environments. The campaign targets developers integrating these SDKs into payment and financial applications. The threat actor's technical sophistication suggests potential future campaigns across ecosystems.
Potential Impact
The malicious packages compromise developer environments by stealing sensitive credentials and tokens used for authentication and API access. This can lead to unauthorized access to payment platforms, cloud services, source code repositories, and other critical infrastructure. The fake SDKs also disrupt normal application behavior by returning fake success responses, potentially masking the attack. The data exfiltration to an AWS-hosted command-and-control server increases the risk of further exploitation and lateral movement within affected organizations.
Mitigation Recommendations
No official patch or fix is available as this is a supply chain malware campaign involving malicious packages. Developers should immediately remove any of the listed malicious packages from their projects and rotate all secrets (API keys, tokens, passwords) on any machine that imported or executed these packages. It is recommended to audit dependency trees for these package names and block them at registry proxy levels. Reviewing CI system logs for usage of PAYSAFE_API_KEY in conjunction with these package names is advised. Vigilance across multiple ecosystems (npm and PyPI) is necessary to detect and prevent similar attacks.
Threat ID: 6a4eabdec9d9e3dbe3aa339b
Added to database: 07/08/2026, 19:58:22 UTC
Last enriched: 07/08/2026, 19:58:29 UTC
Last updated: 07/09/2026, 02:02:38 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.