The fake Paysafe, Skrill, and Neteller SDK campaign shows how attackers are abusing public package repositories to target developers working with payment integrations.

At least 17 malicious npm and PyPI packages were published to impersonate legitimate payment SDKs. The packages used names resembling Paysafe, Skrill, and Neteller libraries, making them appear relevant to developers building payment-related applications.

Once installed, the packages could steal sensitive information such as environment variables, API keys, tokens, credentials, and other secrets from developer machines and CI/CD environments. Some packages also returned fake “success” responses, making the integration appear functional while quietly collecting data.

This is especially dangerous in payment environments because exposed API keys or service credentials may allow attackers to access payment systems, customer data, transaction flows, or connected cloud services.

Organizations should verify package names carefully, use only official vendor SDKs, pin dependencies, and avoid installing unknown packages directly from public repositories. CI/CD systems should use minimal secrets, short-lived credentials, and restricted outbound access.

Security teams should review recent npm and PyPI installations, rotate any payment or cloud credentials exposed in affected environments, and monitor for unusual API activity.

The key lesson is that a package does not become trustworthy because its name looks financial and professional. Attackers know developers search quickly, install faster, and debug later, which is apparently enough of a business model for malware now.

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications. [...]

Source: Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials via Bleeping Computer — published 08 Jul 2026.