The malicious npm package [email protected] masquerades as the official Paysafe payments SDK by using the same package name, description, and repository URL. However, its index.js includes obfuscated code that enumerates environment variables, filters keys containing substrings such as key, secret, token, pass, auth, and api, truncates their values, and sends them along with hostname, username, current working directory, package name, and call metadata to a hardcoded command-and-control server on port 8443. The C2 address and transmission details are concealed through multiple layers of encoding and obfuscation. The package also performs sandbox evasion by checking CPU count and user/hostnames and delays data exfiltration by approximately 26 seconds. Any developer using this package expecting the legitimate Paysafe SDK will inadvertently leak sensitive environment credentials to attackers.

Integration of [email protected] results in unauthorized disclosure of environment variables containing sensitive credentials and secrets. This can lead to compromise of API keys, tokens, passwords, and other authentication material present in the build or runtime environment. The attacker gains access to these secrets remotely via the concealed exfiltration channel, potentially enabling further attacks or unauthorized access to systems and services.

No official patch or remediation is currently available for [email protected]. Users should immediately cease using this package and remove it from their projects. Verify the authenticity of packages by checking publisher details and source repositories before installation. Use trusted sources and official SDKs from Paysafe. Monitor for any unauthorized access or credential misuse resulting from this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.