Bottom line: At least 17 fake payment SDKs on npm and PyPI steal development-related access credentials such as API keys and AWS login data through disguised packages that imitate legitimate application programming interfaces.
Security firm Socket has uncovered a coordinated campaign with at least 17 malicious software packages masquerading as SDKs for Paysafe, Skrill and Neteller distributed across both open-source registries npm and PyPI. The packages harvest access credentials, API keys and AWS login data from development environments and CI/CD pipelines.
The fake packages completely imitate the legitimate application programming interfaces (APIs) and return false success messages to development tools, while data theft runs in the background. Upon superficial code review, they go undetected. Instead of establishing actual connections to the real payment service providers, the libraries redirect requests to command-and-control servers hosted on AWS infrastructure.
For the 13 affected npm packages (versions 1.0.0 to 1.0.3), the espionage routine activates only when the SDK is actively invoked, provided a valid Paysafe API key is simultaneously stored in environment variables. The four PyPI packages, conversely, activate the malicious routine immediately upon initialization without requiring an API key. The attackers have built in simple protection mechanisms: malicious code execution stops if the system has fewer than two processor cores or if the hostname or username indicates a virtual machine—this is intended to block automated security analysis in sandboxes.
Stolen data includes Paysafe API keys, AWS login credentials, GitHub tokens and npm publishing tokens. Affected organizations must replace all compromised passwords and keys immediately. Socket and registry operators recommend searching CI/CD logs specifically for the combination of “PAYSAFE_API_KEY” and affected package names, as well as blocking registry proxies for these packages.
Affected npm packages: paysafe-checkout, paysafe-vault, neteller, skrill-payments, paysafe-js, paysafe-api, paysafe-node, paysafe-cards, paysafe-fraud, paysafe-kyc, skrill, skrill-sdk, paysafe-payments. Affected PyPI packages: paysafe-kyc, paysafe-payments, paysafe-sdk, paysafe-api.
Source: www.it-daily.net · Published 14 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.