Malicious npm and PyPI Packages Target Payment Platforms with Stealer Malware A recent cyberattack campaign leveraged malicious packages on npm and PyPI to distribute stealer malware targeting developers and users of Paysafe, Skrill, and Neteller payment applications. The threat actor published 17 fraudulent packages 13 on npm and 4 on PyPI designed to exfiltrate credentials, access tokens, and other sensitive data to a command-and-control (C2) server hosted on AWS. The targeted platforms are widely used in e-commerce, online gaming, travel, financial services, cryptocurrency exchanges, and Forex trading. The malicious packages mimicked legitimate Paysafe SDKs, exposing fake APIs that returned false success responses while covertly harvesting data. Among the stolen information were Paysafe API keys, AWS credentials, GitHub and npm tokens, hostnames, usernames, and API usage metadata. The npm packages (e.g., paysafe-checkout, skrill-payments) required a Paysafe API key to trigger data exfiltration, while the PyPI packages (e.g., paysafe-sdk, paysafe-api) executed the theft routine automatically upon initialization. The malware also included basic anti-analysis checks, halting execution if it detected virtualized environments or systems with fewer than two CPU cores. Security researchers at Socket identified the campaign but noted that the threat actor’s identity remains unknown. The attack’s cross-ecosystem targeting (npm and PyPI) suggests a technically capable adversary, raising concerns about future, more sophisticated operations. Organizations using the affected packages were advised to rotate all exposed secrets and audit dependency trees for signs of compromise.