The 'paysafe-fraud' npm package (version 1.0.0) masquerades as the Paysafe Fraud Prevention SDK but contains a hidden exfiltration function (__exfil) that activates on every API invocation. This function collects environment variables filtered for sensitive keys (e.g., 'key', 'secret', 'token', 'password', 'auth', 'api'), truncates their values, and combines them with host identifiers such as hostname, username, current working directory, a timestamp, the package name, and part of the caller's API key. The collected data is sent via HTTPS POST to an attacker-controlled server with obfuscated hostname and path, decoded at runtime. The package includes anti-analysis logic that aborts exfiltration if the environment appears to be a sandbox or analyst machine (e.g., CPU count less than 2 or blacklisted hostnames/usernames). This is a credential-stealing payload delivered through a brand-impersonation typosquat.

Use of this package results in the compromise of environment credentials and host information, which are sent to attacker infrastructure. This can lead to credential theft, unauthorized access, and further compromise of the victim's environment. The impact activates immediately upon using the SDK's documented API calls.

No official patch or remediation is currently available for this malicious package. The best mitigation is to avoid using the 'paysafe-fraud' package version 1.0.0 entirely. Verify package authenticity before installation by checking the official Paysafe repositories and using trusted sources. Remove any instances of this package from your environment and audit for potential credential exposure. Monitor for suspicious network traffic to unknown hosts on TCP port 8443.