Fake SDKs for the Paysafe and Skrill payment services found on NPM and PyPI

Malicious libraries posing as the official SDKs of the Paysafe, Skrill and Neteller payment services have been discovered in the public package repositories of the Node Package Manager (NPM) and the Python Package Index (PyPI).

According to Bleeping Computer, the attackers used these packages to distribute a stealer — malware designed to harvest credentials. The victims included both developers who integrated the fake libraries into their projects and users of applications that rely on the payment services in question.

Using NPM and PyPI as a channel for distributing malicious code is a common tactic among cybercriminals. Developers often install packages without thoroughly vetting their contents or the publisher's reputation, which allows attackers to disguise malicious functionality as legitimate libraries from well-known services.

Cybersecurity experts advise developers to carefully verify the sources and authors of packages before installing them, and to use dependency-scanning tools to detect suspicious code in the software supply chain.

Once again, the incident demonstrates the vulnerability of open package-manager ecosystems to supply-chain attacks and underscores the need for heightened vigilance when working with third-party libraries, especially those tied to financial and payment services.

Source: Bleeping Computer