Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials

Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, delivering stealer malware designed to harvest credentials from developers and application users.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Developers and users of Paysafe, Skrill, and Neteller payment applications who installed the malicious SDKs.
Ecosystems
npmPyPI
Attack vectors
TyposquattingCompromised package
Affected entities
  • Paysafe SDK (fake)Malicious SDK impersonating Paysafe on npm and PyPI
  • Skrill SDK (fake)Malicious SDK impersonating Skrill on npm and PyPI
  • Neteller SDK (fake)Malicious SDK impersonating Neteller on npm and PyPI

Fake SDKs for Paysafe, Skrill, and Neteller payment platforms were discovered on the Node Package Manager (npm) and Python Package Index (PyPI) repositories. These malicious packages were designed to impersonate legitimate payment service SDKs, likely using typosquatting or similar naming tactics to deceive developers into installing them.\n\nThe packages contained stealer malware that targeted credential theft from both developers who installed the packages and end-users of applications that integrated the compromised SDKs. This represents a significant supply chain risk, as compromised payment SDKs can expose sensitive financial and authentication data.\n\nThe incident affected developers across both the Node.js and Python ecosystems who relied on these payment service integrations.

Indicators of compromise

Packages
  • paysafe (fake)
  • skrill (fake)
  • neteller (fake)

Remediation

  • Immediately audit npm and PyPI installations for any Paysafe, Skrill, or Neteller SDK packages and verify their authenticity against official vendor repositories
  • Remove any suspicious or unverified payment SDK packages from production environments
  • Review package.json and requirements.txt files for typosquatted or unofficial package names
  • Rotate all credentials and API keys that may have been exposed through the malicious SDKs
  • Monitor for unauthorized access to payment accounts and financial systems
  • Use official package sources and verify package signatures when available
  • Implement dependency scanning tools to detect known malicious packages

Sources

  1. Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials · BleepingComputer

Cite this entry

"Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 8, 2026; last updated July 8, 2026. https://supplychainattack.org/incident/fake-paysafe-skrill-sdks-on-npm-and-pypi-steal-credentials-p02gb6

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

    The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.

    npmPyPICompromised packageTyposquatting
  2. containedcritical

    Malicious code in tyepescript-cli (npm)

    tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.

    npmTyposquattingCompromised package
  3. resolvedcritical

    Malicious code in comander-lib (npm)

    comander-lib@1.0.0 is a typosquat of the legitimate `commander` package containing malicious code. The package's postinstall script exfiltrates system information to a C2 server and downloads and executes a Windows payload, with capability to escape WSL/Linux sandboxes via PowerShell.

    npmTyposquattingCompromised package
  4. resolvedcritical

    Malicious code in core-js-gns (npm)

    The npm package core-js-gns contained malicious code in its postinstall hook that exfiltrated system information and executed remotely-fetched Python code on developer machines. The package name was a typosquat of the legitimate core-js library.

    npmCompromised packageTyposquatting