Fake Paysafe/Skrill/Neteller SDK Supply Chain Credential Stealer
First seen Jul 9, 2026 · Updated Jul 9, 2026
Threat actors published malicious packages on npm and PyPI masquerading as legitimate SDKs for Paysafe, Skrill, and Neteller payment platforms. These packages deliver information-stealing malware that harvests credentials from developers and downstream application users. The campaign highlights the ongoing risk of typosquatting and impersonation attacks within open-source package registries.
Technical Analysis
The malicious packages impersonate legitimate payment SDKs and are distributed via npm and PyPI, exploiting developer trust in these registries to achieve initial infection during dependency installation. Upon install or import, embedded stealer payloads execute to exfiltrate credentials, API keys, and payment-related secrets from developer environments and any application that bundles the compromised package. This is a classic software supply-chain attack vector—no CVE has been assigned as it relies on package impersonation rather than a software vulnerability. Because many AI agent frameworks and automation pipelines pull dependencies from npm/PyPI dynamically (including for payment integrations, tool-use plugins, or agent-driven CI/CD), any agent system that auto-installs or resolves packages from these registries could unknowingly pull the malicious SDK, leading to credential and API key theft that could cascade into broader agent infrastructure compromise. Organizations running autonomous coding agents or agentic package-resolution workflows are particularly exposed if they lack allowlisting or provenance verification for installed packages.
Affected Systems
npm and PyPI package repositories; Node.js and Python development environments that installed the fraudulent Paysafe, Skrill, or Neteller SDK packages; downstream applications and services that bundled these packages into production code
Indicators of Compromise
- Malicious npm packages impersonating Paysafe/Skrill/Neteller SDKs
- Malicious PyPI packages impersonating Paysafe/Skrill/Neteller SDKs
- (Specific package names, hashes, and C2 domains not disclosed in source data)
Remediation Steps
- 1
Audit dependencies
Review all npm and PyPI dependencies for unofficial or unverified Paysafe, Skrill, and Neteller SDK packages and remove any that are not sourced from official vendor channels.
- 2
Rotate exposed credentials
Immediately rotate any API keys, tokens, or credentials that may have been present in development environments where the malicious packages were installed.
- 3
Implement package provenance checks
Use lockfiles, checksum verification, and package signing/provenance tools (e.g., npm provenance, Sigstore) to validate authenticity of third-party packages before installation.
- 4
Restrict automated package installation
For AI agent or CI/CD pipelines that auto-resolve dependencies, enforce allowlists and manual review gates for new or unfamiliar packages, especially payment-related SDKs.
- 5
Monitor for exfiltration indicators
Inspect network logs and endpoint telemetry for unexpected outbound connections from build/development systems following package installation.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.