cyber.hendryadrian.com
Security News · bleepingcomputer.com

Fake Paysafe, Skrill and Neteller SDKs on npm and PyPI Steal Secrets

· Original article ↗

Summary

Socket researchers say at least 17 fake payment SDK packages on npm and PyPI stole credentials and tokens, sending data to an AWS-hosted server. They recommend removing the packages, rotating secrets and checking CI logs.

Key points

  • At least 17 malicious packages across npm and PyPI impersonated Paysafe, Skrill and Neteller SDKs.
  • The packages searched for credentials, passwords, API keys and tokens, including AWS, GitHub and npm tokens.
  • The packages exposed expected APIs but returned fake success responses instead of contacting Paysafe backend services.
  • The npm packages attempted theft when called and when a Paysafe API key was present; the PyPI packages ran their theft routine on initialization without that key.
  • The malware used basic anti-analysis checks, including CPU-core and virtualized-environment cues.
  • Socket researchers said the actor was unknown and warned that switching between package ecosystems could complicate defense.
  • Developers who installed a listed package were advised to rotate secrets, search dependency trees, block the packages at registry proxies and review CI logs.

Article Details

Event Type
Supply-chain attack involving malicious npm and PyPI packages impersonating payment SDKs.
Impact
The packages stole credentials, API keys, tokens, and other secrets from developers and users, then exfiltrated the data to an AWS-hosted command-and-control server.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelThe malicious packages exfiltrated stolen data to a command-and-control server.T1497.001 · System ChecksThe malware used system checks, including CPU-core counts and hostname or username cues, to detect virtualized environments and stop execution.

Products

NetellerMalicious npm and PyPI packages were used to distribute stealer malware targeting developers and users of Paysafe, Skrill, and Neteller payment applications.PaySafeMalicious npm and PyPI packages were used to distribute stealer malware targeting developers and users of Paysafe, Skrill, and Neteller payment applications.SkrillMalicious npm and PyPI packages were used to distribute stealer malware targeting developers and users of Paysafe, Skrill, and Neteller payment applications.