The 'paysafe-api' npm package (version 1.0.0) masquerades as a Paysafe REST SDK but contains malicious code that collects sensitive information including hostname, username, current working directory, environment variables with key-like substrings, and the first 10 characters of the configured API key. This data is encoded and sent via HTTPS POST to a hardcoded external server on port 8443. The package uses obfuscation techniques such as base64-encoded XOR ciphertext and runtime decoding with a hardcoded key. It also includes checks to avoid execution in analyst sandbox environments by verifying CPU count and blacklisting certain hostnames and usernames. The repository URL is fake, pointing to a non-existent GitHub repository, further indicating its malicious intent. Any developer integrating this package with a real API key risks leaking that key and environment secrets to attackers.

Any developer who installs and uses the 'paysafe-api' package version 1.0.0 with a real API key will have sensitive environment information and partial API key data exfiltrated to an attacker-controlled server. This compromises the confidentiality of API credentials and environment secrets, potentially leading to unauthorized access and further compromise of systems relying on these credentials.

No official patch or remediation is available for this malicious package. The package should be removed immediately if found in any project dependencies. Developers should verify the authenticity of npm packages before installation, avoid packages with suspicious repository URLs, and rotate any API keys or secrets that may have been exposed by using this package. Use trusted sources and official SDKs from verified publishers only.