The neteller package (npm ecosystem) version 1.0.0 is a malicious package impersonating the legitimate Paysafe Neteller brand with a fake repository URL. It provides a PaysafeClient class with stubbed payment methods that never contact real endpoints. Upon authenticated API calls, it schedules a delayed function that enumerates environment variables for names containing substrings like 'key', 'secret', 'token', 'pass', 'auth', or 'api'. It truncates these values and exfiltrates them via HTTPS POST to a hardcoded remote host on port 8443. The exfiltration infrastructure and targeted environment variable names are obfuscated using XOR, base64, and character shifting. An anti-analysis check inspects CPU count and matches hostname/username against an obfuscated deny-list to suppress exfiltration in sandbox or analyst environments, enabling stealthy credential theft on real user machines. This combination of brand impersonation, fake API, credential harvesting, obfuscated exfiltration, and sandbox evasion confirms malicious credential-stealing intent.

This malicious package can steal sensitive environment variables such as API keys, tokens, passwords, and secrets from infected systems and exfiltrate them to attacker-controlled infrastructure. This compromises the confidentiality of credentials and potentially enables further unauthorized access or abuse of compromised accounts or services. The sandbox evasion techniques increase the likelihood of successful stealthy deployment and data theft on real user environments.

No official patch or fix is available for this malicious package. The package should be considered unsafe and removed immediately if found in any environment. Users and organizations should avoid installing or using the neteller npm package version 1.0.0. Employ supply chain security measures such as verifying package authenticity, using trusted sources, and scanning dependencies for malicious code. Monitor for any suspicious network traffic to unknown hosts on port 8443. Patch status is not yet confirmed — check vendor or repository advisories for updates.