The 'paysafe-checkout' npm package (version 1.0.0) is a credential-stealing lure disguised as a legitimate Paysafe Checkout SDK. Its 'index.js' defines a fake PaysafeClient with dummy API methods that return success responses to avoid suspicion. Upon any method call, it schedules a delayed function that exfiltrates the installer's hostname, username, current working directory, a timestamp, the API key prefix supplied by the caller, and environment variables containing sensitive substrings (KEY, SECRET, TOKEN, PASS, AUTH, API) to a hardcoded remote server over HTTPS on port 8443. The exfiltration details such as destination hostname and HTTP headers are obfuscated using base64 and XOR with a hardcoded key to evade static analysis. It also includes anti-analysis checks to avoid exfiltration in sandbox or virtualized environments. This malicious behavior enables attackers to harvest sensitive credentials from developers who mistakenly integrate this package.

Any developer or organization that installs and uses 'paysafe-checkout' version 1.0.0 risks exposing their Paysafe API keys and other sensitive environment credentials to attackers. The stolen data includes system identifiers and filtered environment variables containing secrets, which can lead to unauthorized access and compromise of related services. The package's anti-analysis features increase the likelihood that the malicious activity goes undetected during automated scans or sandbox analysis.

No official patch or remediation is currently available for this malicious package. Users should immediately remove 'paysafe-checkout' version 1.0.0 from their projects and replace it with the legitimate Paysafe SDK obtained from trusted sources. Avoid using unverified or suspicious npm packages, especially those impersonating known services. Monitor for any unauthorized access or credential misuse resulting from this exposure. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.