Criminals uploaded 17 fake software packages that imitate the Paysafe, Skrill, and Neteller payment
tools developers build with. Any developer machine or build system that installed one had its
passwords, keys, and access tokens copied and sent to the attacker. Check now whether your teams
installed any of these packages, remove them, and change every credential on affected machines.
1.Campaign Timeline
13 npm and 4 PyPI packages went live nearly simultaneously on 7 July 2026 under names imitating Paysafe, Skrill, and Neteller SDKs, including paysafe-checkout, skrill-sdk, neteller, and paysafe-payments. Each npm package shipped four malicious versions (1.0.0 to 1.0.3); each PyPI package shipped one. The actor rotated obfuscation keys across packages and versions, so no two files share a hash.
2.Targeting Profile
Developers and CI/CD systems integrating Paysafe, Skrill, or Neteller payment SDKs. Payment SDK targeting points to a financial motive or intent to monetise payment app accounts. The npm and PyPI spread impedes defenders with visibility into only one ecosystem.
3. Attack Chain
Initial access
Actor publishes typosquatted package names on npm and PyPI. Developers install them by mistyping a package name or trusting a plausible SDK name.
Initial access
npm packages expose a fake PaysafeClient that returns success responses without calling real Paysafe
endpoints. When any API method runs with an API key set, exfiltration triggers after a delay. PyPI packages activate on import with no key gate.
Defence evasion
Malware skips exfiltration on machines with fewer than 2 CPU cores or hostnames and usernames containing terms such as sandbox, cuckoo, vmware, or vbox. The C2 hostname is hidden behind XOR decode, character shift, and string reversal.
4. Payload Capabilities
The packages carry a credential stealer with these confirmed capabilities:
Credential harvesting Copies every environment variable whose name contains KEY, SECRET, TOKEN, PASS, AUTH, or API. Typical catches include PAYSAFE_API_KEY, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and NPM_TOKEN.
Victim fingerprinting Sends hostname, username, current working directory, timestamp, package name, and the first 10 characters of the Paysafe API key with each upload
Exfiltration HTTPS POST to caliber-spinner-finishing[.]ngrok-free[.]dev, an ngrok tunnel. The resolved IP has prior reputation command and control for NjRAT-class stealers, which may indicate shared cybercrime infrastructure.
Signature resistance A unique obfuscation key per package and version produces a different file hash for every sample, defeating hash-based detection.
5. Indicators of Compromise (IOCs)
6. Recommendations
- Search dependency trees and lockfiles for the 17 campaign package names across npm and PyPI; remove any matches and block the names at your registry proxy.
- Treat any machine that installed these packages as compromised; rotate all secrets, especially environment variables containing KEY, SECRET, TOKEN, PASS, AUTH, or API.
- Hunt outbound HTTPS to .ngrok-free.dev from build, CI, and developer hosts; this traffic is not normal for payment SDK integrations.
- Audit CI logs for PAYSAFE_API_KEY usage alongside any of the listed package names to spot triggered exfiltration.
- Monitor for the IOCs. Block the IOCs at their respective controls, using the full VirusTotal collection:
7. Sources
https://socket.dev/blog/npm-pypi-campaign-typosquats-popular-secure-payment-apps
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.
