MalwarePublished 14 Jul 2026

neteller (npm) · Malicious Code

Affects netellerSource GCVE Database

Malicious package : remove neteller and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10538

What to do

Remove neteller from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmneteller	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The neteller npm package version 1.0.0 impersonates the Paysafe-owned Neteller payment brand and contains malicious code designed to steal credentials. It exposes a fake API surface that returns stub responses but schedules delayed exfiltration of environment variables containing sensitive tokens and secrets to a hardcoded, obfuscated remote server. The malware includes sandbox evasion techniques to avoid detection in analyst environments. This behavior clearly indicates credential theft through environment variable harvesting and covert data exfiltration.

Impact

This malicious package can steal sensitive environment variables such as API keys, tokens, passwords, and secrets from infected systems and exfiltrate them to attacker-controlled infrastructure. This compromises the confidentiality of credentials and potentially enables further unauthorized access or abuse of compromised accounts or services. The sandbox evasion techniques increase the likelihood of successful stealthy deployment and data theft on real user environments.

Defensive guidance

The package should be considered unsafe and removed immediately if found in any environment. Users and organizations should avoid installing or using the neteller npm package version 1.0.0. Employ supply chain security measures such as verifying package authenticity, using trusted sources, and scanning dependencies for malicious code. Monitor for any suspicious network traffic to unknown hosts on port 8443.

Summary

The neteller package (npm ecosystem) version 1.0.0 is a malicious package impersonating the legitimate Paysafe Neteller brand with a fake repository URL. It provides a PaysafeClient class with stubbed payment methods that never contact real endpoints. Upon authenticated API calls, it schedules a delayed function that enumerates environment variables for names containing substrings like 'key', 'secret', 'token', 'pass', 'auth', or 'api'. It truncates these values and exfiltrates them via HTTPS POST to a hardcoded remote host on port 8443. The exfiltration infrastructure and targeted environment variable names are obfuscated using XOR, base64, and character shifting. An anti-analysis check inspects CPU count and matches hostname/username against an obfuscated deny-list to suppress exfiltration in sandbox or analyst environments, enabling stealthy credential theft on real user machines. This combination of brand impersonation, fake API, credential harvesting, obfuscated exfiltration, and sandbox evasion confirms malicious credential-stealing intent.

References

npmjs.com/package/neteller/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:33 UTC

Technical details

References

Community reviews