The paysafe-api PyPI package version 1.0.0 is identified as malicious software that, when used, executes code to exfiltrate environment variables and other basic data to an external server. The package uses obfuscation and sandbox detection to avoid detection and analysis. It is part of a dependency confusion attack campaign, where attackers publish malicious packages with names similar to legitimate ones to trick users into installing them. No CVSS score is assigned, and no official patch or remediation is indicated in the data.

Users who install and use paysafe-api version 1.0.0 risk having sensitive environment variables and basic system data exfiltrated to a remote attacker-controlled host. This can lead to credential leakage, unauthorized access, and further compromise of the affected systems. The malicious code's sandbox detection and obfuscation increase the difficulty of detection and analysis.

Since no official patch or remediation is provided, users should immediately cease using paysafe-api version 1.0.0 and remove it from their environments. Avoid installing packages from untrusted sources and verify package authenticity before use. Monitor for any signs of compromise related to this package. Patch status is not yet confirmed — check the vendor advisory or PyPI security advisories for updates.