paysafe-vault

{"modified":"2026-07-10T18:38:15Z","published":"2026-07-10T18:38:15Z","schema_version":"1.7.4","id":"MAL-2026-10173","summary":"Malicious code in paysafe-vault (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1)\nThe package impersonates a Paysafe Customer Vault SDK but is a credential stealer. index.js defines an __exfil() routine that collects os.hostname(), os.userInfo().username, process.cwd(), and every process.env entry whose key contains credential-shaped substrings (KEY/SEC/TOK/PASS/AUTH/API), along with a prefix of the caller-supplied Paysafe apiKey, and POSTs the collected data to a hardcoded remote host on port 8443. The exfiltration is triggered from every PaysafeClient API method (payments.*, customers.*) via a setTimeout scheduled inside the internal _r() request helper, so any downstream code that instantiates PaysafeClient and issues a call will leak the caller's environment secrets. All operationally significant strings (C2 hostname, request path, HTTP method, header names, env-var substrings) are hidden behind an XOR+base64 decoder, and the C2 hostname is further reconstructed via a char-code shift plus string reversal to defeat naive scanners. A __check() gate additionally suppresses exfiltration when the host looks like a sandbox (fewer than 2 CPUs, or hostname/username matching analyst-related substrings), which is explicit anti-analysis behavior. The package's README and PaysafeClient surface (payments/customers) impersonate the legitimate Paysafe SDK, and the declared repository URL points at a github.com/paysafe org path the publisher does not control.\n","affected":[{"package":{"ecosystem":"npm","name":"paysafe-vault"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"4a4b5c1bc1e948c853cb0978c07c7b8d1540c7b1ded95f8d5ad25c126cb6c7b0","tlsh":"b96163b1b2e9a52777600fe059b18429ad5e9c003d45f3d7b6ac78cd8a631b193e6c3c"}],"package_integrity":[{"filename":"paysafe-vault-1.0.0.tgz","hashes":{"sha1":"5a7ed14d886abbcb606ac358a0ee8cac470fb62d","sha512_sri":"sha512-PAj+ZrtqHJIOOdTumHjzM4wW5hfYjPIhYzwioy/GaWlhQaYs+kLremXdzZhm94rG6JzJK6oIn2bD8w06ADiMvA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/paysafe-vault/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009705","import_time":"2026-07-10T19:02:48.657700816Z","modified_time":"2026-07-10T18:38:15Z","sha256":"bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1","source":"amazon-inspector","versions":["1.0.0"]}]}}