The malicious 'skrill' npm package version 1.0.0 masquerades as the official Skrill API wrapper but instead implements stubbed payment and customer methods that return fake success responses. Concurrently, it collects environment variables with names containing credential-related substrings (e.g., 'KEY', 'SECRET', 'TOKEN'), truncates their values, and sends them along with system metadata and the caller's API key prefix to a hardcoded remote server on port 8443. The exfiltration parameters are obfuscated using base64 and XOR encoding decoded at runtime with a hardcoded binary key. The exfiltration is delayed by approximately 11 seconds to evade synchronous detection. Additionally, the package performs sandbox detection by inspecting CPU count and searching for sandbox or virtual machine indicators in hostname and username, aborting exfiltration if detected. This behavior allows attackers to harvest sensitive credentials and environment information from developers who mistakenly integrate this malicious package.

Users who install and use the 'skrill' npm package version 1.0.0 risk having sensitive environment variables, including API keys, secrets, and tokens, exfiltrated to an attacker-controlled server. This can lead to credential compromise, unauthorized access to payment systems, and potential downstream attacks leveraging stolen secrets. The package also returns fake success responses, potentially misleading developers and automated systems into believing operations succeeded while their secrets are stolen.

No official patch or remediation is currently available for this malicious package. Users should immediately remove the 'skrill' package version 1.0.0 from their projects and replace it with the legitimate Skrill (Paysafe) SDK obtained from official sources. Audit environment variables and secrets for potential compromise and rotate any exposed credentials. Avoid using unverified or suspicious packages from public repositories. Monitor for any unauthorized access resulting from leaked credentials.