The paysafe-kyc npm package (version 1.0.0) masquerades as the official Paysafe KYC SDK but contains malicious code. Instead of calling Paysafe APIs, its PaysafeClient methods return hardcoded success responses. A delayed exfiltration routine collects the host's hostname, username, current working directory, the prefix of any supplied API key, the package name, and the first 100 characters of any environment variables containing sensitive substrings (KEY, SECRET, TOKEN, PASS, AUTH, API). This data is sent via an HTTPS request to a hardcoded command-and-control server on TCP port 8443. The package uses XOR and base64 obfuscation for strings and further obfuscates the C2 hostname. It includes sandbox evasion by checking CPU count and known analysis VM hostnames/usernames, aborting if detected. The package's metadata impersonates Paysafe to trick developers into supplying real Paysafe API keys and other credentials, which are then leaked.

Sensitive credentials and environment variables, including Paysafe API keys and other secrets, can be exfiltrated to an attacker-controlled server. This compromises the confidentiality of credentials used by the affected system, potentially leading to unauthorized access to Paysafe services and other integrated systems. The malicious package also misleads developers by returning fake success responses, masking the exfiltration activity.

No official patch or fix is currently available for this malicious package. The best mitigation is to immediately remove the paysafe-kyc package version 1.0.0 from all projects and dependency trees. Avoid using packages that impersonate trusted brands without verification. Audit environment variables and secrets for potential exposure and rotate any credentials that may have been compromised. Use trusted sources and verify package authenticity before installation.