Researchers from the application‑security firm Socket have identified a coordinated campaign that publishes 17 malicious packages on the two largest open‑source registries—npm and PyPI. The packages masquerade as official SDKs for the payment processors Paysafe, Skrill and Neteller, yet their hidden payloads harvest credentials and forward them to a command‑and‑control (C2) server hosted on Amazon Web Services (AWS).

How the fake SDKs operate

The package list includes names such as npm/paysafe-checkout, npm/skrill-payments, and pypi/paysafe-sdk. The npm side released four versions (1.0.0‑1.0.3), while the PyPI side offered a single version (1.0.0). All packages expose the expected API surface, instantly returning a “success” response without ever contacting Paysafe’s backend services. Behind the façade, a stealer module scans the host environment for secrets—API keys, AWS credentials, GitHub tokens, npm tokens, hostnames, usernames and usage metadata—and ships them to the attacker’s server.

Technical analysis and anti‑analysis tricks

Socket’s reverse‑engineering shows that the malware contains rudimentary anti‑analysis checks. Execution aborts if fewer than two CPU cores are detected or if the hostname/user‑name suggests a virtualised environment. The npm payload activates only when a Paysafe API key is present, whereas the PyPI payload triggers on import, requiring no key at all. This dual‑mode design maximises the chance of data exfiltration across diverse development pipelines.

Business impact and broader risk

Paysafe, Skrill and Neteller SDKs are embedded in thousands of e‑commerce sites, gaming platforms, travel booking services and fintech SaaS products. A single compromised dependency can leak privileged credentials, enabling unauthorized transactions, large‑scale fraud, and even ransomware attacks on downstream services. The threat is amplified in continuous‑integration (CI) environments where dependencies are automatically fetched, potentially spreading the malicious code across multiple projects without manual intervention.

Mitigation recommendations

Socket advises immediate rotation of all secrets on any machine that has imported or executed the listed packages. Developers should audit their dependency trees for the exact package names, block them at the registry‑proxy level, and scan CI logs for occurrences of PAYSAFE_API_KEY alongside these packages. Organizations must adopt multi‑ecosystem visibility—monitoring both npm and PyPI activity—to prevent similar cross‑registry attacks from slipping through a single‑point detection strategy.