Someone published 17 fake packages on npm and PyPI posing as Paysafe, Skrill, and Neteller SDKs. Their real job? Stealing credentials and access tokens.
Security firm Socket found the campaign. The threat actor uploaded all 17 packages at nearly the same time. Each one exfiltrates data to a command-and-control server hosted on AWS. The npm packages shipped four malicious versions (1.0.0 through 1.0.3), while the PyPI ones only published version 1.0.0.
The packages look legit. They expose the expected APIs and return fake success responses instead of talking to Paysafe’s backend. But under the hood, they search compromised environments for secrets — API keys, AWS keys, GitHub tokens, npm tokens, hostnames, usernames, metadata.
Here’s the difference between ecosystems: the npm versions only start stealing if a Paysafe API key is present. The PyPI versions activate immediately on import, no API key required.
The malware has basic anti-analysis tricks. It stops if it detects fewer than 2 CPU cores or if the hostname suggests a virtualized environment. Not sophisticated, but enough to dodge some automated sandboxes.
Socket warns the attacker might be back in a more organized way. Pivoting between ecosystems makes defense harder if you’re only monitoring one registry.
If you installed any of these packages, rotate every secret on that machine immediately. Check your CI logs for PAYSAFE_API_KEY paired with these package names. Also deny requests for them at the registry proxy level.
Affected npm packages: paysafe-checkout, paysafe-vault, neteller, skrill-payments, paysafe-js, paysafe-api, paysafe-node, paysafe-cards, paysafe-fraud, paysafe-kyc, skrill, skrill-sdk, paysafe-payments. Affected PyPI: paysafe-kyc, paysafe-payments, paysafe-sdk, paysafe-api.
