Malicious NPM & PyPI Packages Masquerading as Paysafe, Skrill SDKs Steal Payment API Keys and Developer Secrets
What Happened — Threat actors published 17 counterfeit SDK packages on the public npm and PyPI registries that mimic official Paysafe, Skrill, and Neteller libraries. The packages contain stealer code that harvests API keys, cloud credentials, GitHub tokens, and other secrets from any environment where they are installed.
Why It Matters for Compliance & Audit Readiness
- Credential theft from third‑party libraries is a classic SOC 2 CC 6.2 (Access Control) failure – you must demonstrate that only authorized, vetted code runs in production.
- Continuous monitoring of third‑party dependencies provides audit‑ready evidence that your organization enforces a “trusted‑source only” policy.
- The incident underscores the need for documented security‑awareness training on supply‑chain risks, a required control in SOC 2 CC 7.1.
Who Is Affected – E‑commerce platforms, online marketplaces, gaming and travel sites, SaaS providers, cryptocurrency exchanges, and any developer integrating Paysafe, Skrill, or Neteller payment SDKs.
Recommended Actions
- Enforce strict Software Bill of Materials (SBOM) and SCA tooling to detect malicious packages before they enter your CI/CD pipeline.
- Rotate any exposed API keys, AWS credentials, and tokens immediately; enforce short‑lived secrets where possible.
- Update your access‑control policies to require multi‑factor authentication for all developer accounts and enforce least‑privilege for service accounts.
- Conduct targeted security‑awareness training on open‑source supply‑chain threats.
- Capture evidence of package vetting and key rotation for SOC 2 audit trails.
Source: BleepingComputer
Technical Notes – The malicious npm packages only activate when a Paysafe API key is detected; the PyPI variants run on import regardless of key presence. Exfiltration is performed via an AWS‑hosted C2 server. The code includes basic anti‑analysis checks (CPU core count, hostname patterns).