The 'skrill-payments' package (version 1.0.0) is a supply-chain malware that impersonates a Skrill payments SDK by spoofing repository URLs and class names. Its advertised methods (e.g., payments.create/get, customers.create/get) return mock success responses but trigger a hidden exfiltration routine after approximately 19.7 seconds. This routine collects environment variables with names containing sensitive keywords (key, secret, token, pass, auth, api), truncates their values, and combines them with system metadata and a prefix of the caller-supplied apiKey. The collected data is JSON-serialized and sent via an HTTP POST request to a hardcoded command-and-control server on port 8443. The package employs multiple layers of obfuscation, including base64 and XOR encoding of strings and a char-shift plus reverse operation on the C2 hostname. It also includes sandbox evasion logic that aborts execution if the CPU count is less than two or if the hostname/username matches analyst environment indicators. This behavior clearly identifies it as malicious supply-chain malware targeting developer environments.

This malicious package can exfiltrate sensitive environment variables that likely contain credentials, API keys, tokens, and secrets from developer workstations. The stolen data includes partial environment variable values, system hostname, OS username, current working directory, package name, timestamp, and a prefix of the API key used. This can lead to credential compromise, unauthorized access to services, and further downstream attacks. The package's obfuscation and sandbox evasion increase the difficulty of detection and analysis.

No official patch or remediation is currently available for this malicious package. Users should immediately avoid installing or using 'skrill-payments' version 1.0.0 from npm. Remove any existing installations of this package from development environments. Review environment variables and credentials potentially exposed and rotate any secrets that may have been compromised. Monitor for any suspicious network traffic to unknown hosts on port 8443. Exercise caution when adding third-party packages and verify the authenticity of packages and their sources before use.