Socket: Coordinated npm/PyPI Campaign Typosquats Paysafe, Skrill, Neteller Payment SDKs

What it is

A coordinated supply-chain campaign of 17 malicious npm and PyPI packages, published nearly simultaneously on July 7, 2026, typosquatting the Paysafe, Skrill, and Neteller payment SDKs. Named example: paysafe-node, exporting a fake PaysafeClient. Each npm package shipped four versions (1.0.0–1.0.3); each PyPI package shipped one version (1.0.0). Socket detected the npm packages as malware within 6 minutes of publication.

How it works

The fake SDK exposes plausible methods (payments.create/get, customers.create/get) that return { success: true, ... } immediately and never call real Paysafe endpoints — the api.paysafe.com strings are camouflage. When a _request() runs with an API key present, it schedules exfiltrate() via setTimeout(..., 11768) (~11.8s delay). Exfiltration sends a JSON payload over HTTPS containing hostname, username, cwd, timestamp, hardcoded package name, first 10 chars of the API key, and every environment variable whose name contains KEY, SECRET, TOKEN, PASS, AUTH, or API (values capped at 100 chars).

The C2 host is decoded in three steps — XOR against a base64 key, subtract 17 from each char code, then reverse — yielding caliber-spinner-finishing.ngrok-free.dev. Before sending, isSandbox() returns early if there are <2 CPU cores, or if hostname/username contains sandbox, analyzer, cuckoo, virus, malware, vmware, or vbox.

Behavioral split worth noting: npm exfiltration is gated on an API key being set (constructor arg or PAYSAFE_API_KEY). PyPI packages are not gated on any key — they activate universally via __init__.py placement on import.

Preconditions / Affected

Developers or CI runners that installed one of the typosquatted packages. On npm, exfiltration additionally requires an API key to be configured before a request method fires; on PyPI, mere import triggers it. Captured secrets in practice include PAYSAFE_API_KEY, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and NPM_TOKEN.

What to do

• Block/hunt for outbound HTTPS to the C2:

caliber-spinner-finishing.ngrok-free.dev

• Audit npm/PyPI installs for the typosquatted Paysafe/Skrill/Neteller package names (versions npm 1.0.0–1.0.3, PyPI 1.0.0).
• Treat any secret exposed to an affected environment as compromised and rotate it — API keys, AWS keys, GitHub and npm tokens.

Caveats

The C2 uses an ngrok-free.dev tunnel, so the endpoint is ephemeral and the IOC may rotate. The blog's intro line states data goes to "AWS infrastructure," but the code shown exfiltrates only to the ngrok host — the page does not reconcile these. The full package list is not reproduced in the fetched text (the affected-package tables did not render).