Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were discovered on npm and PyPI, distributing stealer malware to developers and end users.
Security researchers identified fraudulent software development kits targeting three major payment platforms on open-source package repositories. The fake packages mimicked legitimate Paysafe, Skrill, and Neteller SDKs, making them difficult to distinguish from authentic versions.
Once installed, the malicious packages deployed stealer malware designed to extract sensitive credentials from compromised systems. The threat affected both developers who integrated the SDKs into applications and end users who may have downloaded them indirectly through compromised dependencies.
The discovery highlights ongoing supply chain vulnerabilities in popular package managers. npm and PyPI, while critical infrastructure for software development, remain targets for attackers distributing malware through typosquatting and package impersonation tactics.
Developers using Paysafe, Skrill, or Neteller payment integrations should audit their dependencies immediately. The repositories have removed the malicious packages, but systems that installed them during the distribution window face potential compromise.
This incident follows a pattern of attacks on package managers. Previous incidents have compromised popular libraries, affecting thousands of downstream projects. Security experts recommend implementing stricter package verification processes, using package signing, and monitoring for suspicious activity in dependency chains.
Organizations handling payment processing should prioritize scanning their codebases for these fake SDKs and rotating any compromised credentials. Both npm and PyPI encourage developers to report suspicious packages immediately and enable two-factor authentication on package accounts.
The incident underscores the need for better vetting mechanisms in open-source repositories and heightened vigilance when installing third-party packages, particularly those related to sensitive operations like payment processing.
Visa is enabling expired payment cards to continue processing contactless transactions through a new feature. The move allows cardholders to keep using their old cards for tap-to-pay purchases even after expiration.
A Texas-based student discovered and reported an unauthorized AI system being used for cyberattacks. The disclosure prompted immediate investigation and security responses from affected organizations.
Iranian cyber actors shut down a small UK power generation facility for four days, according to sources cited by The Telegraph. The incident coincides with a broader wave of attacks targeting US water utilities attributed to Iran-affiliated groups.
A supply-chain attack is exploiting legitimate device-update apps to infect Android-based car head units with malware. The compromised devices are being enlisted into proxy botnets or used for ad fraud schemes.