Security researchers have uncovered a coordinated malware campaign hiding inside fake developer packages pretending to be official tools for Paysafe, Skrill, and Neteller, three widely used online payment platforms.
The malicious code was built to quietly harvest API keys, tokens, and other sensitive credentials from developer machines. Stolen data was sent to attacker controlled servers, putting financial infrastructure and payment flows at risk.
The campaign involved seventeen malicious packages spread across npm and PyPI, published within a short window of each other.
Each package was designed to look like a genuine software development kit, complete with realistic function names and API structures mimicking the real Paysafe, Skrill, and Neteller libraries.
Developers who unknowingly installed these packages while building payment integrations exposed their systems to silent credential theft.
Researchers from Socket.dev identified the campaign and noted that the packages performed no real payment processing at all, instead returning fake success responses to avoid suspicion while stealing data in the background.
Socket said in a report shared with Cyber Security News (CSN) that its automated scanner flagged the packages within minutes of publication, showing how quickly modern detection systems can catch such threats.
Still, the packages remained live long enough to pose a real risk to developers. The attackers showed real sophistication, using different obfuscation keys for nearly every file so no two packages shared identical signatures.
This made it harder for antivirus tools to flag the code through simple pattern matching. Combined with sandbox evasion tricks, the campaign reflects an actor familiar with the open source ecosystem and its defenses.
Hackers Use Fake Paysafe, Skrill, and Neteller Packages
Each malicious package, such as the npm package paysafe-node, exported a class resembling a real payment client, reading environment variables like PAYSAFE_API_KEY and logging every request.
Instead of calling real Paysafe endpoints, the code returned a fake success message while a hidden function collected the developer’s hostname, username, working directory, and environment variables containing words like KEY, SECRET, TOKEN, PASS, AUTH, or API.
This meant the malware could scoop up far more than Paysafe credentials, capable of grabbing AWS secret keys, GitHub tokens, npm publishing tokens, and other sensitive values in the same environment.
The stolen information was packaged into a JSON payload and sent to a remote server over HTTPS, while the fake SDK appeared to work normally.
The PyPI versions behaved almost identically, though they activated automatically once imported rather than waiting for an API key to be set.
This made the Python packages arguably more dangerous, since they could trigger data theft even in testing environments where no live credentials were expected.
Evasion Tactics and Command Infrastructure
To avoid detection during automated analysis, the malware checked for signs it was running inside a sandbox or virtual machine before sending stolen data.
It looked at the number of available CPU cores and scanned the hostname and username for words like sandbox, analyzer, cuckoo, or vmware, quietly skipping exfiltration if any were detected.
The command and control address was hidden behind multiple layers of encoding, requiring an XOR operation, a character shift, and a string reversal before the real domain became readable.
That domain was built on ngrok, a legitimate tunneling service popular among cybercriminals because it can mask a server’s true location.
Researchers also noted that the IP address behind this ngrok hostname had previously been linked to command and control activity for other known credential stealing malware, suggesting the attacker may share infrastructure with established cybercrime groups.
This raises the possibility the campaign was part of a broader, reusable toolkit rather than a one off effort.
Socket’s researchers recommend that anyone who installed these packages immediately rotate every secret that may have been exposed, particularly variables matching the harvested patterns.
Teams should also scan dependency trees for the known malicious package names, block them at the registry proxy level, and audit build logs for outbound connections to ngrok-free.dev domains.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
