The paysafe-node package (version 1.0.0) is a malicious npm package impersonating a legitimate Paysafe SDK. Its main entry point contains XOR-obfuscated code that, upon invocation of any advertised SDK method, triggers a delayed callback to exfiltrate sensitive environment variables (those containing 'key', 'secret', 'token', 'pass', 'auth', or 'api') truncated to 100 characters. It also collects machine hostname, OS username, current working directory, timestamp, package identifier, and part of the caller-supplied Paysafe apiKey, sending all this data via POST to a hardcoded remote server on TCP port 8443. The exfiltration destination and network details are obfuscated using XOR and character transformations. The payload includes sandbox and VM evasion by checking CPU count and matching hostname/username against obfuscated tokens. No configuration or disclosure is provided to users, indicating an active attack rather than a vulnerability or misconfiguration.

Sensitive credentials and environment information are exfiltrated to an attacker-controlled server without user knowledge or consent. This can lead to compromise of API keys, secrets, tokens, and potentially broader system access or data breaches. The malicious code targets developer and CI environments by evading sandbox and VM detection, increasing the risk of credential theft in real development workflows.

No official patch or remediation is available for this malicious package. Users should immediately remove paysafe-node version 1.0.0 from their projects and replace it with a verified legitimate SDK from trusted sources. Audit environments for any signs of credential exfiltration and rotate any potentially exposed secrets. Avoid using untrusted or impersonating packages from public repositories.