MalwarePublished 23 Sep 2025Updated 8 Sep 2026

paypal-postman-lib (npm) · Malicious Code

Affects paypal-postman-libSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmpaypal-postman-lib	Affected >=2.0.9 =2.0.9 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'paypal-postman-lib' impersonates PayPal/Postman branding but contains malicious code that collects the host's hostname and OS user identity and sends this information to a third-party domain associated with malicious activity. Installing or requiring this package compromises the host by exposing sensitive system identity data. The package provides no legitimate functionality and poses a significant security risk to any system where it is installed.

Impact

Systems with this package installed or running should be considered fully compromised. Sensitive information such as hostnames and OS user identities are exfiltrated to a malicious third party. This exposure can lead to further unauthorized access or exploitation. All secrets and keys on the affected system should be rotated immediately from a separate, trusted machine. Simply removing the package does not guarantee elimination of all malicious software or backdoors introduced by the attacker.

Defensive guidance

Remove the 'paypal-postman-lib' package immediately from all affected systems. Rotate all secrets, credentials, and keys that were stored on the compromised machine from a different, secure device. Because the package may have allowed full system compromise, consider rebuilding or thoroughly auditing the affected systems to ensure no persistent backdoors remain.

Summary

The 'paypal-postman-lib' npm package imports system modules to read the host's hostname and user information, then transmits this data via HTTPS to a domain linked to malicious activity. The package masquerades as a legitimate PayPal/Postman library but only performs data exfiltration. Installation or execution of this package results in the compromise of host identity information, potentially enabling further malicious actions. The package versions 1.0.1 and 2.0.9 (including >=2.0.9) are affected. Removal of the package alone may not fully remediate the compromise, as the attacker may have gained broader control over the system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 05:37 UTC

Technical details

References

Community reviews