Malicious SDKs on NPM and PyPI Steal Credentials from Developers and Users of Popular Payment Platforms
A sophisticated cyber attack has been discovered on two popular software repositories, leaving developers and users of Paysafe, Skrill, and Neteller payment applications vulnerable to credential theft. The attackers published at least 17 malicious packages simultaneously on the Node Package Manager (npm) and the Python Package Index (PyPI), each designed to exfiltrate sensitive information to a command-and-control server hosted on Amazon Web Services (AWS).
The affected platforms are widely used in various industries, including e-commerce, online betting, cryptocurrency exchanges, and Forex trading. Developers integrate these payment SDKs into their applications and websites to implement secure payments and funds management systems. However, the malicious packages pretend to be legitimate payment SDKs, exposing expected APIs while secretly stealing credentials.
According to application security company Socket, which discovered the attack, the 13 npm packages published four malicious versions, from 1.0.0 to 1.0.3, whereas the PyPI packages published only one malicious version, 1.0.0. The embedded malicious code searches compromised environments for secrets such as tokens, passwords, and API keys, including Paysafe API keys, AWS keys, GitHub tokens, npm tokens, hostname, username, and metadata about API usage.
The attackers’ goal is to steal sensitive information, which can be used to compromise multiple ecosystems. Socket’s analysis reveals that the malware includes basic anti-analysis features, stopping execution if it detects fewer than 2 CPU cores or if the hostname or username contains cues indicating a virtualized environment.
While the identity of the threat actor remains unclear, the attackers’ technical expertise and ability to pivot between ecosystems suggest that they may return in a more organized way. This highlights the importance for security teams to be vigilant and proactive in defending against such attacks.
If you’re a developer who has installed any of the listed packages, it’s essential to take immediate action. Rotate all secrets on any machine that imported or executed this package, and search dependency trees for the package names used in the campaign. Deny any requests for them at the registry proxy level, and review your Continuous Integration (CI) systems’ logs for signs of compromise.
The attack serves as a reminder to prioritize security and regularly test all layers of your environment before attackers do. By doing so, you can detect potential threats and prevent them from slipping through undetected.
Source: Bleeping Computer — 2026-07-08