Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials

Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, delivering stealer malware designed to harvest credentials from developers and application users.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Developers and users of Paysafe, Skrill, and Neteller payment applications who installed the malicious SDKs.
Ecosystems
npmPyPI
Attack vectors
TyposquattingCompromised package
Affected entities
  • Paysafe SDK (fake)Malicious SDK impersonating Paysafe on npm and PyPI
  • Skrill SDK (fake)Malicious SDK impersonating Skrill on npm and PyPI
  • Neteller SDK (fake)Malicious SDK impersonating Neteller on npm and PyPI

Fake SDKs for Paysafe, Skrill, and Neteller payment platforms were discovered on the Node Package Manager (npm) and Python Package Index (PyPI) repositories. These malicious packages were designed to impersonate legitimate payment service SDKs, likely using typosquatting or similar naming tactics to deceive developers into installing them.\n\nThe packages contained stealer malware that targeted credential theft from both developers who installed the packages and end-users of applications that integrated the compromised SDKs. This represents a significant supply chain risk, as compromised payment SDKs can expose sensitive financial and authentication data.\n\nThe incident affected developers across both the Node.js and Python ecosystems who relied on these payment service integrations.

Indicators of compromise

Packages
  • paysafe (fake)
  • skrill (fake)
  • neteller (fake)

Remediation

  • Immediately audit npm and PyPI installations for any Paysafe, Skrill, or Neteller SDK packages and verify their authenticity against official vendor repositories
  • Remove any suspicious or unverified payment SDK packages from production environments
  • Review package.json and requirements.txt files for typosquatted or unofficial package names
  • Rotate all credentials and API keys that may have been exposed through the malicious SDKs
  • Monitor for unauthorized access to payment accounts and financial systems
  • Use official package sources and verify package signatures when available
  • Implement dependency scanning tools to detect known malicious packages

Sources

  1. Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials · BleepingComputer

Cite this entry

"Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 8, 2026; last updated July 8, 2026. https://supplychainattack.org/incident/fake-paysafe-skrill-sdks-on-npm-and-pypi-steal-credentials-p02gb6

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

    The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.

    npmPyPICompromised packageTyposquatting
  2. resolvedcritical

    Malicious code in @dgxeon13/libsignal-node (npm)

    @dgxeon13/libsignal-node is a malicious npm package that impersonates Signal's libsignal Node binding. Upon require, it executes code that modifies @whiskeysockets/baileys to inject a payload enabling remote-controlled WhatsApp newsletter auto-follow functionality.

    npmCompromised packageTyposquatting
  3. resolvedcritical

    Malicious code in @years19/n8n-nodes-utils-helper-f (npm)

    The npm package @years19/n8n-nodes-utils-helper-f contained malicious code that exfiltrates host identity and environment data to an attacker-controlled server during installation and on require. The package mimics legitimate n8n community node naming conventions.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

    The npm package @years18/n8n-nodes-utils-helper-t contained malicious code that executed on installation and require(), exfiltrating system information, establishing a command channel, and deploying a DDoS toolkit. The package name was designed to mimic a legitimate n8n community node.

    npmCompromised packageTyposquatting