Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, delivering stealer malware designed to harvest credentials from developers and application users.
- Disclosed
- Last updated
- Blast radius
- Developers and users of Paysafe, Skrill, and Neteller payment applications who installed the malicious SDKs.
- Attack vectors
- Affected entities
- Paysafe SDK (fake)Malicious SDK impersonating Paysafe on npm and PyPI
- Skrill SDK (fake)Malicious SDK impersonating Skrill on npm and PyPI
- Neteller SDK (fake)Malicious SDK impersonating Neteller on npm and PyPI
Fake SDKs for Paysafe, Skrill, and Neteller payment platforms were discovered on the Node Package Manager (npm) and Python Package Index (PyPI) repositories. These malicious packages were designed to impersonate legitimate payment service SDKs, likely using typosquatting or similar naming tactics to deceive developers into installing them.\n\nThe packages contained stealer malware that targeted credential theft from both developers who installed the packages and end-users of applications that integrated the compromised SDKs. This represents a significant supply chain risk, as compromised payment SDKs can expose sensitive financial and authentication data.\n\nThe incident affected developers across both the Node.js and Python ecosystems who relied on these payment service integrations.
Indicators of compromise
- Packages
- paysafe (fake)
- skrill (fake)
- neteller (fake)
Remediation
- Immediately audit npm and PyPI installations for any Paysafe, Skrill, or Neteller SDK packages and verify their authenticity against official vendor repositories
- Remove any suspicious or unverified payment SDK packages from production environments
- Review package.json and requirements.txt files for typosquatted or unofficial package names
- Rotate all credentials and API keys that may have been exposed through the malicious SDKs
- Monitor for unauthorized access to payment accounts and financial systems
- Use official package sources and verify package signatures when available
- Implement dependency scanning tools to detect known malicious packages
Sources
- Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials · BleepingComputer
Cite this entry
"Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 8, 2026; last updated July 8, 2026. https://supplychainattack.org/incident/fake-paysafe-skrill-sdks-on-npm-and-pypi-steal-credentials-p02gb6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.
npmPyPICompromised packageTyposquatting - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in comander-lib (npm)
comander-lib@1.0.0 is a typosquat of the legitimate `commander` package containing malicious code. The package's postinstall script exfiltrates system information to a C2 server and downloads and executes a Windows payload, with capability to escape WSL/Linux sandboxes via PowerShell.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in core-js-gns (npm)
The npm package core-js-gns contained malicious code in its postinstall hook that exfiltrated system information and executed remotely-fetched Python code on developer machines. The package name was a typosquat of the legitimate core-js library.
npmCompromised packageTyposquatting