The paysafe-vault npm package version 1.0.0 is a credential-stealing malicious package masquerading as the Paysafe Customer Vault SDK. It defines an internal __exfil() function that collects sensitive environment data including os.hostname(), os.userInfo().username, process.cwd(), and environment variables containing substrings like KEY, SEC, TOK, PASS, AUTH, and API. This data, combined with a prefix of the caller-supplied Paysafe apiKey, is sent via a POST request to a hardcoded command-and-control server on port 8443. The exfiltration is triggered on every PaysafeClient API call (payments.* and customers.*) through a delayed internal request helper. The package uses XOR and base64 encoding plus character shifting and string reversal to obfuscate operational strings and evade naive detection. It also suppresses exfiltration if the host appears to be a sandbox (e.g., fewer than 2 CPUs or analyst-related hostnames/usernames), indicating anti-analysis behavior. The package's README and API surface mimic the legitimate SDK, and the declared repository URL falsely claims affiliation with the official Paysafe GitHub organization.

Users who install and use paysafe-vault version 1.0.0 risk having sensitive environment credentials and API keys exfiltrated to a remote attacker-controlled server. This can lead to credential compromise, unauthorized access to systems or services, and potential downstream impacts depending on the stolen credentials. The malicious package's anti-analysis features reduce detection likelihood, increasing risk of unnoticed compromise.

No official patch or remediation is currently available for paysafe-vault version 1.0.0. Users should immediately cease using this package and remove it from their projects. Verify the authenticity of npm packages before installation, especially those impersonating well-known SDKs. Use trusted sources and official repositories. Monitor for any suspicious network activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.