MalwarePublished 14 Jul 2026

skrill (npm) · Malicious Code

Affects skrillSource GCVE Database

Malicious package : remove skrill and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:33 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10542

What to do

Remove skrill from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmskrill	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'skrill' npm package version 1.0.0 is a malicious package impersonating the legitimate Skrill (Paysafe) payments SDK. It exports a PaysafeClient class that returns stubbed success responses while covertly harvesting environment variables containing credential-like substrings. The harvested data, including truncated secrets, hostname, username, current working directory, timestamp, and API key prefix, is exfiltrated via a delayed JSON POST to a hardcoded remote server. The exfiltration details are obfuscated using base64 and XOR encoding with a hardcoded key. The package includes sandbox evasion techniques by checking CPU count and environment indicators to avoid detection on analysis machines. Developers using this package risk leaking sensitive credentials and environment information to an attacker-controlled host.

Impact

Users who install and use the 'skrill' npm package version 1.0.0 risk having sensitive environment variables, including API keys, secrets, and tokens, exfiltrated to an attacker-controlled server. This can lead to credential compromise, unauthorized access to payment systems, and potential downstream attacks leveraging stolen secrets. The package also returns fake success responses, potentially misleading developers and automated systems into believing operations succeeded while their secrets are stolen.

Defensive guidance

Users should immediately remove the 'skrill' package version 1.0.0 from their projects and replace it with the legitimate Skrill (Paysafe) SDK obtained from official sources. Audit environment variables and secrets for potential compromise and rotate any exposed credentials. Avoid using unverified or suspicious packages from public repositories. Monitor for any unauthorized access resulting from leaked credentials.

Summary

The malicious 'skrill' npm package version 1.0.0 masquerades as the official Skrill API wrapper but instead implements stubbed payment and customer methods that return fake success responses. Concurrently, it collects environment variables with names containing credential-related substrings (e.g., 'KEY', 'SECRET', 'TOKEN'), truncates their values, and sends them along with system metadata and the caller's API key prefix to a hardcoded remote server on port 8443. The exfiltration parameters are obfuscated using base64 and XOR encoding decoded at runtime with a hardcoded binary key. The exfiltration is delayed by approximately 11 seconds to evade synchronous detection. Additionally, the package performs sandbox detection by inspecting CPU count and searching for sandbox or virtual machine indicators in hostname and username, aborting exfiltration if detected. This behavior allows attackers to harvest sensitive credentials and environment information from developers who mistakenly integrate this malicious package.

References

npmjs.com/package/skrill/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:33 UTC

Technical details

References

Community reviews