Executive Summary
In July 2026, a coordinated supply-chain attack targeted developers integrating payment services by distributing at least 17 malicious packages on the npm and PyPI repositories. These packages masqueraded as legitimate SDKs for Paysafe, Skrill, and Neteller, aiming to steal sensitive credentials such as API keys, AWS keys, and GitHub tokens. The attackers employed typosquatting techniques, publishing packages with names closely resembling authentic ones, leading to unauthorized access and potential data breaches.
This incident underscores the escalating threat of supply-chain attacks within open-source ecosystems. The attackers' ability to infiltrate multiple package managers simultaneously highlights the need for enhanced vigilance and security measures among developers and organizations to safeguard against such sophisticated threats.
Why This Matters Now
The increasing prevalence of supply-chain attacks targeting open-source repositories poses significant risks to software integrity and security. Developers and organizations must prioritize the verification of package authenticity and implement robust security practices to mitigate potential breaches.
Attack Path Analysis
Attackers published malicious packages on npm and PyPI, impersonating legitimate Paysafe, Skrill, and Neteller SDKs to compromise developers' systems. Upon installation, these packages executed code to search for and exfiltrate sensitive credentials to an attacker-controlled server. The exfiltrated data included API keys, AWS credentials, GitHub tokens, and other sensitive information. The stolen credentials could be used to escalate privileges, move laterally within networks, and establish command and control channels. Ultimately, the attackers could exfiltrate additional data and cause significant impact by leveraging the compromised credentials.
Kill Chain Progression
Initial Compromise
Description
Attackers published 17 malicious packages on npm and PyPI, impersonating legitimate Paysafe, Skrill, and Neteller SDKs to deceive developers into installing them.
MITRE ATT&CK® Techniques
User Execution: Malicious Library
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Unsecured Credentials
Application Layer Protocol
Obfuscated Files or Information
File and Directory Discovery
Command and Scripting Interpreter
Impair Defenses
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Supply Chain Risk Management
Control ID: Supply Chain Risk Management
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Supply-chain attacks targeting payment SDKs directly threaten core infrastructure, exposing API keys and credentials essential for secure transaction processing and compliance.
Computer Software/Engineering
Developers integrating fake Paysafe/Skrill packages face credential theft and compromised development environments, requiring immediate secret rotation and dependency auditing measures.
Gambling/Casinos
Heavy reliance on Skrill and Neteller payment systems creates significant exposure to credential theft, potentially compromising customer payment data and regulatory compliance.
Internet
E-commerce platforms using compromised payment SDKs face data exfiltration risks affecting customer transactions, AWS keys, and critical payment processing infrastructure security.
Sources
- Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentialshttps://www.bleepingcomputer.com/news/security/fake-paysafe-skrill-sdks-on-npm-and-pypi-steal-credentials/Verified
- Typosquatted npm packages used to steal cloud and CI/CD secretshttps://www.microsoft.com/en-us/security/blog/2026/05/28/typosquatted-npm-packages-used-steal-cloud-ci-cd-secrets/Verified
- TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIOhttps://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to move laterally and exfiltrate sensitive data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF may have limited the attacker's ability to exploit compromised workloads by enforcing strict segmentation and access controls.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation could have limited the attacker's ability to access sensitive credentials by enforcing strict access controls and minimizing trust boundaries.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security could have constrained the attacker's ability to move laterally by monitoring and controlling internal traffic flows.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control could have limited the attacker's ability to establish command and control channels by providing comprehensive monitoring across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement could have restricted the attacker's ability to exfiltrate data by enforcing strict outbound traffic policies.
The implementation of CNSF controls could have reduced the overall impact by limiting the attacker's ability to exploit stolen credentials and access critical systems.
Impact at a Glance
Affected Business Functions
- Payment Processing
- User Authentication
- Transaction Management
Estimated downtime: 3 days
Estimated loss: $50,000
API keys, AWS credentials, GitHub tokens, npm tokens, hostnames, usernames, and metadata about API usage.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access between workloads and limit lateral movement.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Utilize Threat Detection & Anomaly Response to identify and respond to suspicious activities promptly.
- • Apply Inline IPS (Suricata) to detect and prevent known exploit patterns and malicious payloads.
- • Ensure Multicloud Visibility & Control to maintain comprehensive oversight across all cloud environments.
