Typosquatting Campaign Poisons npm and PyPI to Steal Payment App Credentials
Attackers exploited developer trust by publishing 17 malicious packages across npm and PyPI with names closely mimicking legitimate PaySafe, Skrill, and Neteller SDKs — a classic typosquatting supply chain attack. Each package contained credential-stealing malware designed to harvest API keys, tokens, and secrets from environment variables and silently exfiltrate them to an attacker-controlled ngrok server. The use of obfuscation and sandbox evasion techniques made automated detection significantly harder, extending the window of exposure. This attack matters because developers often install packages quickly without verifying authenticity, and a single compromised dependency can expose entire production environments and financial infrastructure. Supply chain attacks of this nature are increasingly coordinated across multiple ecosystems simultaneously, amplifying reach and impact.
Tactical Insight
Immediate actions
- Audit all recently installed npm and PyPI packages related to PaySafe, Skrill, and Neteller and verify their authenticity against official publisher sources.
- Rotate any API keys, tokens, and secrets stored in environment variables on systems where suspicious packages may have been executed.
- Block outbound connections to ngrok domains and similar tunneling services at the network perimeter.
Long-term improvements
- Enforce a curated, internally mirrored package registry (e.g., Artifactory, Nexus) so developers only install pre-vetted dependencies.
- Implement a software composition analysis (SCA) tool in your CI/CD pipeline to automatically flag suspicious or typosquatted package names before installation.
- Adopt a secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager) to eliminate plaintext secrets stored in environment variables.
Detection measures
- Monitor for anomalous outbound network traffic to tunneling or dynamic DNS services (e.g., ngrok, localtunnel) from developer workstations and build servers.
- Enable dependency confusion and typosquatting alerts via tools like Socket.dev or Phylum integrated into your development workflow.
- Establish a baseline of approved third-party packages and alert on any deviation detected during dependency installation.