skrill

{"modified":"2026-07-14T03:38:02Z","published":"2026-07-14T03:38:02Z","schema_version":"1.7.4","id":"MAL-2026-10542","summary":"Malicious code in skrill (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7d4219c6698feb94554982491eef6e0cc533353d46c42e4a7c8679ace1264602)\nPackage published as 'skrill' with description 'Skrill API wrapper' and repository 'github.com/paysafe/skrill' impersonates the Skrill (Paysafe) payments SDK. It exports a PaysafeClient class whose payments.create/get and customers.create/get methods return stubbed success responses while covertly harvesting installer secrets. On any method invocation the code enumerates process.env, filters keys by credential-shaped substrings ('KEY', 'SECRET', 'TOKEN', etc.), truncates values to 100 chars, and includes them together with hostname, username, cwd, current timestamp, and the caller-supplied API key prefix in a JSON POST to a hardcoded remote host on port 8443. The destination host, HTTP method, path, header names, env-var match tokens, and sandbox indicators are all stored as base64+XOR blobs decoded at runtime by a helper (`__x`) using a hardcoded binary key, so the exfiltration destination and credential-scraping tokens do not appear as plain strings in source. Exfiltration is scheduled through setTimeout with an ~11s delay to avoid synchronous detection, and a `__check()` gate inspects CPU count and hostname/username for sandbox/virtual/analysis substrings and aborts on match to stay dormant on researcher machines. Developers who integrate this believing it is a real Skrill SDK will pass live payment API keys to a class that both stubs the response and ships their credentials plus surrounding environment secrets off-host.\n","affected":[{"package":{"ecosystem":"npm","name":"skrill"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"289f0a8d67ddc0742e67ced11fa62dc93bdbef3b492fa859d7d537a9f154c33b","tlsh":"79e06823cba1896304b413519c644342f2229f1f48209c0b33fb001c83f22a31ddab18"},{"path":"index.js","sha256":"5cd62e708ae4393c99579ec1433571998299bf7e2fde9bafeb9a79f8bdf065e9","tlsh":"8d614131b3eda43776904fe54cb58005985e59413e01f397b6ac78cf5e63a9282ea83c"}],"package_integrity":[{"filename":"skrill-1.0.0.tgz","hashes":{"sha1":"5c4d51c080ef55686b5b288d374823b36c3f1348","sha512_sri":"sha512-AgKS+VLB2PGqQl7suQVxVDpSW4mtMj9hd0ohGXZYkJ/zpRfd5tHPD7TYRfVj+yzC4CccyYVamjXAgBcrhE/Q7A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/skrill/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010376","import_time":"2026-07-14T04:31:59.679590383Z","modified_time":"2026-07-14T03:38:02Z","sha256":"7d4219c6698feb94554982491eef6e0cc533353d46c42e4a7c8679ace1264602","source":"amazon-inspector","versions":["1.0.0"]}]}}