MAL-2026-6928: Malicious code in paysafe-payments (PyPI)
The paysafe-payments package version 1.0.0 on PyPI contains malicious code that exfiltrates basic data and sensitive environment variables to a remote host. The malicious code includes obfuscation techniques and sandbox detection to evade analysis. This package is part of a known malicious campaign involving dependency confusion and hidden malicious actions within library usage.
AI Analysis
Technical Summary
The paysafe-payments PyPI package version 1.0.0 has been identified as malicious. When a specific class in the package is used, it exfiltrates environment variables and other basic data to a remote server. The package employs obfuscation and sandbox detection to avoid detection and analysis. This is part of a broader malicious campaign (2026-07-paysafe-api) that leverages dependency confusion and hides malicious actions within legitimate library usage.
Potential Impact
Use of the malicious paysafe-payments package version 1.0.0 can lead to unauthorized disclosure of sensitive environment variables and other basic data to an attacker-controlled remote host. This compromises confidentiality and may facilitate further attacks or data breaches.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove version 1.0.0 of paysafe-payments from their environments and avoid installing or using this package. Verify dependencies to prevent dependency confusion attacks and use trusted sources for package installation.
MAL-2026-6928: Malicious code in paysafe-payments (PyPI)
Description
The paysafe-payments package version 1.0.0 on PyPI contains malicious code that exfiltrates basic data and sensitive environment variables to a remote host. The malicious code includes obfuscation techniques and sandbox detection to evade analysis. This package is part of a known malicious campaign involving dependency confusion and hidden malicious actions within library usage.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The paysafe-payments PyPI package version 1.0.0 has been identified as malicious. When a specific class in the package is used, it exfiltrates environment variables and other basic data to a remote server. The package employs obfuscation and sandbox detection to avoid detection and analysis. This is part of a broader malicious campaign (2026-07-paysafe-api) that leverages dependency confusion and hides malicious actions within legitimate library usage.
Potential Impact
Use of the malicious paysafe-payments package version 1.0.0 can lead to unauthorized disclosure of sensitive environment variables and other basic data to an attacker-controlled remote host. This compromises confidentiality and may facilitate further attacks or data breaches.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove version 1.0.0 of paysafe-payments from their environments and avoid installing or using this package. Verify dependencies to prevent dependency confusion attacks and use trusted sources for package installation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6928
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4e4ee9c9d9e3dbe3289ccd
Added to database: 07/08/2026, 13:21:45 UTC
Last enriched: 07/08/2026, 13:41:33 UTC
Last updated: 07/09/2026, 04:18:57 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.