Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials

A threat actor has published 17 malicious packages on npm and PyPI that impersonate legitimate Paysafe, Skrill, and Neteller SDKs to steal credentials and access tokens. These packages mimic real software development kits but instead exfiltrate sensitive data such as API keys, tokens, and system metadata to an AWS-hosted command-and-control server. The malware includes basic anti-analysis techniques and targets developers integrating payment functionality, with different activation triggers between npm and PyPI versions.

AI-extracted · verify before operational use