Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps

A coordinated campaign across npm and PyPI registries has been identified, distributing 17 malicious packages that typosquat popular payment SDKs such as PaySafe, Skrill, and Neteller. The packages mimic legitimate SDKs to harvest environment variables containing sensitive data like API keys, tokens, and credentials. The stolen data is exfiltrated to an AWS-hosted C2 server using ngrok infrastructure, with anti-sandboxing and obfuscation techniques employed to evade detection.

AI-extracted · verify before operational use