Malicious npm and PyPI Packages Deliver Stealer Malware Targeting Paysafe, Skrill, and Neteller Developer Ecosystems

Threat actors published malicious packages on both npm and PyPI impersonating libraries used by developers of the Paysafe, Skrill, and Neteller payment platforms, delivering infostealer malware to any developer or user who installed the trojanized dependencies. The campaign follows a pattern of fintech-targeted supply chain attacks that leverage developer trust in package registries to seed credential stealers inside CI/CD pipelines and developer workstations. Security teams with dependencies on payment-adjacent open source packages should audit lock files and run retrospective scans on build systems.

The campaign follows a pattern of fintech-targeted supply chain attacks that leverage developer trust in package registries to seed credential stealers inside CI/CD pipelines and developer workstations.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.