MalwareBleeping Computer
9.0 — CRITICAL
Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Malicious packages on npm and PyPI delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications, exfiltrating credentials and access tokens to a command-and-control server hosted on AWS.
⚙️Technical Details
Affected Systems
npmPyPIPaysafeSkrillNeteller
Attack Vectors
Malicious packages on npmMalicious packages on PyPIFake SDKs exposing expected APIs but returning fake success responses
💥Impact Assessment
Severity: critical
🛡️Recommended Actions
1Rotate all secrets on any machine that imported or executed the malicious package
2Search dependency trees for the package names used in the campaign and deny any requests for them at the registry proxy level
3Look in the logs of Continuous Integration (CI) systems for PAYSAFE_API_KEY in combination with any of the listed package names
📦Affected Products
npm/paysafe-checkoutnpm/paysafe-vaultnpm/netellernpm/skrill-paymentsnpm/paysafe-jsnpm/paysafe-apinpm/paysafe-nodenpm/paysafe-cardsnpm/paysafe-fraudnpm/paysafe-kycpypi/paysafe-kycpypi/paysafe-paymentspypi/paysafe-sdkpypi/paysafe-api
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.