Malicious code in paysafe-api (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9ce9ede35fc7679965ba83f58e829a328482bf1fbdb2e450d23e20bed24d708f) The package presents itself as a Paysafe REST SDK (PaysafeClient with payments and customers methods) but the SDK methods are stubs that return {success:true} while scheduling a covert exfiltration call whenever an apiKey is configured. The __exfil helper collects os.hostname(), os.userInfo().username, process.cwd(), a filtered subset of process.env whose names match KEY/SECRET/TOKEN/PASS/AUTH/API-like substrings, and the first 10 characters of the caller's API key, then POSTs the JSON payload over HTTPS to a hardcoded host on port 8443. All sensitive identifiers (the 'https' module name, header names, hostname, env-var substrings) are stored as base64-encoded XOR ciphertext and decoded at runtime by an __x() helper using a hardcoded key. A __check() gate aborts execution when cpus() reports fewer than 2 CPUs or when the hostname/username match an analyst-sandbox blacklist, ensuring the payload only fires on real developer machines. The package name and description impersonate the legitimate Paysafe SDK namespace and the declared repository URL points to a non-existent github.com/paysafe/paysafe-api repo. Any developer who integrates this package with a real API key will leak that key plus environment secrets to the attacker on first SDK call.
AI Analysis
Technical Summary
The 'paysafe-api' npm package (version 1.0.0) masquerades as a Paysafe REST SDK but contains malicious code that collects sensitive information including hostname, username, current working directory, environment variables with key-like substrings, and the first 10 characters of the configured API key. This data is encoded and sent via HTTPS POST to a hardcoded external server on port 8443. The package uses obfuscation techniques such as base64-encoded XOR ciphertext and runtime decoding with a hardcoded key. It also includes checks to avoid execution in analyst sandbox environments by verifying CPU count and blacklisting certain hostnames and usernames. The repository URL is fake, pointing to a non-existent GitHub repository, further indicating its malicious intent. Any developer integrating this package with a real API key risks leaking that key and environment secrets to attackers.
Potential Impact
Any developer who installs and uses the 'paysafe-api' package version 1.0.0 with a real API key will have sensitive environment information and partial API key data exfiltrated to an attacker-controlled server. This compromises the confidentiality of API credentials and environment secrets, potentially leading to unauthorized access and further compromise of systems relying on these credentials.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The package should be removed immediately if found in any project dependencies. Developers should verify the authenticity of npm packages before installation, avoid packages with suspicious repository URLs, and rotate any API keys or secrets that may have been exposed by using this package. Use trusted sources and official SDKs from verified publishers only.
Malicious code in paysafe-api (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9ce9ede35fc7679965ba83f58e829a328482bf1fbdb2e450d23e20bed24d708f) The package presents itself as a Paysafe REST SDK (PaysafeClient with payments and customers methods) but the SDK methods are stubs that return {success:true} while scheduling a covert exfiltration call whenever an apiKey is configured. The __exfil helper collects os.hostname(), os.userInfo().username, process.cwd(), a filtered subset of process.env whose names match KEY/SECRET/TOKEN/PASS/AUTH/API-like substrings, and the first 10 characters of the caller's API key, then POSTs the JSON payload over HTTPS to a hardcoded host on port 8443. All sensitive identifiers (the 'https' module name, header names, hostname, env-var substrings) are stored as base64-encoded XOR ciphertext and decoded at runtime by an __x() helper using a hardcoded key. A __check() gate aborts execution when cpus() reports fewer than 2 CPUs or when the hostname/username match an analyst-sandbox blacklist, ensuring the payload only fires on real developer machines. The package name and description impersonate the legitimate Paysafe SDK namespace and the declared repository URL points to a non-existent github.com/paysafe/paysafe-api repo. Any developer who integrates this package with a real API key will leak that key plus environment secrets to the attacker on first SDK call.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'paysafe-api' npm package (version 1.0.0) masquerades as a Paysafe REST SDK but contains malicious code that collects sensitive information including hostname, username, current working directory, environment variables with key-like substrings, and the first 10 characters of the configured API key. This data is encoded and sent via HTTPS POST to a hardcoded external server on port 8443. The package uses obfuscation techniques such as base64-encoded XOR ciphertext and runtime decoding with a hardcoded key. It also includes checks to avoid execution in analyst sandbox environments by verifying CPU count and blacklisting certain hostnames and usernames. The repository URL is fake, pointing to a non-existent GitHub repository, further indicating its malicious intent. Any developer integrating this package with a real API key risks leaking that key and environment secrets to attackers.
Potential Impact
Any developer who installs and uses the 'paysafe-api' package version 1.0.0 with a real API key will have sensitive environment information and partial API key data exfiltrated to an attacker-controlled server. This compromises the confidentiality of API credentials and environment secrets, potentially leading to unauthorized access and further compromise of systems relying on these credentials.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The package should be removed immediately if found in any project dependencies. Developers should verify the authenticity of npm packages before installation, avoid packages with suspicious repository URLs, and rotate any API keys or secrets that may have been exposed by using this package. Use trusted sources and official SDKs from verified publishers only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10166
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a520ebf68715ace438f59ac
Added to database: 07/11/2026, 09:37:03 UTC
Last enriched: 07/11/2026, 09:55:03 UTC
Last updated: 07/27/2026, 06:22:38 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.