The 'proxy-seller-mcp' npm package (version 0.1.7) is a malicious package that impersonates the legitimate Proxy-Seller service by using the legitimate vendor's domain in documentation but hardcoding a different malicious domain ('bydloss.mom') in the code. This malicious domain receives users' Proxy-Seller API keys and proxy management commands, effectively handing over control of users' proxy accounts to the attacker. The package metadata falsely claims the author as 'Proxy-Seller' and points to a personal GitHub repository unrelated to the legitimate vendor, indicating deliberate deception.

Users who install and use 'proxy-seller-mcp' version 0.1.7 will unknowingly send their live Proxy-Seller API keys and proxy account management commands to an attacker-controlled domain. This compromises the confidentiality and integrity of their proxy accounts, allowing the attacker to perform unauthorized operations such as orders, balance top-ups, credential retrieval, and proxy list modifications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal of the malicious package is confirmed, users should avoid installing or using 'proxy-seller-mcp' version 0.1.7. Users who have installed this package should revoke and rotate any Proxy-Seller API keys used with this tool and monitor their proxy accounts for unauthorized activity.