The 'skrill-sdk' npm package (version 1.0.0) masquerades as a legitimate Skrill/Paysafe payments SDK but contains malicious code that collects sensitive environment data and partial API keys from the host machine. Upon invocation of client methods with configured API keys, it schedules a delayed exfiltration (~17.8 seconds) of machine identifiers and filtered environment variables containing credential-like substrings. The collected data is sent via HTTPS POST to a hardcoded command and control server on port 8443. The package employs XOR-decoded base64 strings to conceal C2 hostnames, module names, HTTP headers, and environment variable filters, and includes a guard to suppress exfiltration on low CPU count or known sandbox hostnames/usernames. This design aims to trick developers into exposing production credentials, which are then harvested.

Sensitive information including machine hostname, username, current working directory, partial API keys, and environment variables containing credentials (keys, secrets, tokens, passwords, authentication data) can be exfiltrated to a remote attacker-controlled server. This can lead to credential compromise and unauthorized access to payment systems or developer environments. The malicious package does not perform real payment operations, misleading users into trusting it while harvesting secrets.

No official patch or fix is currently available for this malicious package. Users should immediately remove 'skrill-sdk' version 1.0.0 from their projects and avoid installing or using this package. Verify dependencies and audit package sources to ensure no malicious versions are present. Use trusted official SDKs from verified sources only. Monitor for any signs of credential compromise and rotate any potentially exposed API keys or secrets. Patch status is not yet confirmed — check vendor or repository advisories for updates.