Affected Systems
Developers using npm and PyPI repositories who may have installed counterfeit packages impersonating Paysafe, Skrill, and Neteller payment SDKs. Affects development environments and potentially downstream applications integrating these malicious packages.
Exploitation Status
Active supply chain attack. Malicious packages were published to npm and PyPI repositories and available for download. Packages deliver stealer malware to infected systems. Current distribution status and removal timeline unknown.
Business Impact
Developers who installed these malicious packages may have compromised development environments with stealer malware capable of exfiltrating credentials, API keys, source code, and sensitive data. Applications built with these packages may contain embedded malware, creating a cascading supply chain risk to end users. Payment processing integrations are high-value targets for credential theft.
Urgency
🔴 Immediate
Recommended Actions
- Audit all npm and PyPI dependencies for packages named after Paysafe, Skrill, or Neteller and verify against official vendor documentation for legitimate package names
- Scan development environments and build systems for indicators of compromise, focusing on outbound network connections and credential access patterns
- Review application builds from the past 90 days that may have incorporated these malicious packages and assess redeployment needs
- Rotate API keys, credentials, and secrets accessible from any development environment that installed suspicious payment SDK packages
- Implement package verification controls such as npm package lock file reviews and dependency scanning tools (e.g., Snyk, Socket, npm audit) in CI/CD pipelines