A Sneaky Credential Thief Has Been Lurking on Popular Package Managers
A group of malicious packages has been discovered on both the Node Package Manager (npm) and the Python Package Index (PyPI), compromising the credentials of users who rely on popular payment platforms such as Paysafe, Skrill, and Neteller. These fake software development kits (SDKs) have been masquerading as legitimate payment solutions, but in reality, they are designed to steal sensitive information from unsuspecting developers.
The threat actor behind this campaign has published at least 17 malicious packages, each tailored to exfiltrate credentials and access tokens to a command-and-control server hosted on Amazon Web Services (AWS). These compromised packages have been masquerading as legitimate payment SDKs, exposing the expected APIs but returning fake success responses instead of communicating with the backend services. The real purpose is credential theft, as the embedded malicious code searches for secrets such as tokens, passwords, and API keys in compromised environments.
The affected payment platforms are widely used by e-commerce sites, online marketplaces, gaming platforms, travel businesses, financial services, and software-as-a-service (SaaS) providers. Software developers working on these platforms integrate Paysafe’s SDKs into apps and websites to implement a secure payments and funds management system. The researchers warn that the attacker’s ability to pivot between ecosystems may make it more difficult to defend if there is only one ecosystem of visibility.
According to application security company Socket, the 13 npm packages published four malicious versions, from 1.0.0 to 1.0.3, whereas the PyPI packages published only one malicious version, 1.0.0. The researchers have identified some basic anti-analysis features in the malware, including stopping execution if it detects fewer than 2 CPU cores or if the hostname or username contains cues indicating a virtualized environment.
The exfiltrated data includes Paysafe API keys, AWS keys, GitHub tokens, npm tokens, hostname, username, and metadata about API usage. If any of the listed packages were installed, developers are recommended to immediately rotate all secrets on any machine that imported or executed this package. The researchers also advise searching dependency trees for the package names used in the campaign and denying any requests for them at the registry proxy level.
In light of this discovery, it is essential for security teams to remain vigilant and take proactive measures to prevent such attacks. Regularly monitoring package dependencies, keeping software up-to-date, and conducting thorough vulnerability assessments can help mitigate the risk of similar incidents occurring in the future. As the Picus whitepaper emphasizes, testing every layer before attackers do is crucial to preventing breaches and ensuring that security systems are effective in detecting threats.
Source: Bleeping Computer — 2026-07-08