The paysafe-payments npm package (version 1.0.0) is a malicious typosquat that mimics the Paysafe payments SDK API surface. Its index.js contains XOR and base64 obfuscated code that, when the PaysafeClient is instantiated and its methods called, collects the hostname, username, current working directory, and environment variables containing sensitive keys (e.g., KEY, SECRET, TOKEN, PASS, AUTH, API). This data is encoded as JSON and sent via HTTP POST to a hardcoded command-and-control server on port 8443. The package employs sandbox evasion by checking CPU count and matching hostname/username against a list of known analysis environment indicators, suppressing exfiltration if detected. All sensitive strings are stored obfuscated to conceal malicious behavior.

This malicious package can lead to credential theft by exfiltrating environment variables and host information from systems where it is installed and executed. The stolen data may include API keys, tokens, passwords, and other secrets, potentially compromising downstream services and infrastructure that rely on these credentials.

No official patch or remediation is currently available. Users should avoid installing or using the paysafe-payments package version 1.0.0 from npm. Verify package authenticity by checking the publisher and using the legitimate Paysafe SDK from trusted sources. Remove any instances of this malicious package from your environment. Monitor for any suspicious outbound connections to unknown hosts on port 8443. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.