{"id":"MAL-2026-10173","summary":"Malicious code in paysafe-vault (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1)\nThe package impersonates a Paysafe Customer Vault SDK but is a credential stealer. index.js defines an __exfil() routine that collects os.hostname(), os.userInfo().username, process.cwd(), and every process.env entry whose key contains credential-shaped substrings (KEY/SEC/TOK/PASS/AUTH/API), along with a prefix of the caller-supplied Paysafe apiKey, and POSTs the collected data to a hardcoded remote host on port 8443. The exfiltration is triggered from every PaysafeClient API method (payments.*, customers.*) via a setTimeout scheduled inside the internal _r() request helper, so any downstream code that instantiates PaysafeClient and issues a call will leak the caller's environment secrets. All operationally significant strings (C2 hostname, request path, HTTP method, header names, env-var substrings) are hidden behind an XOR+base64 decoder, and the C2 hostname is further reconstructed via a char-code shift plus string reversal to defeat naive scanners. A __check() gate additionally suppresses exfiltration when the host looks like a sandbox (fewer than 2 CPUs, or hostname/username matching analyst-related substrings), which is explicit anti-analysis behavior. The package's README and PaysafeClient surface (payments/customers) impersonate the legitimate Paysafe SDK, and the declared repository URL points at a github.com/paysafe org path the publisher does not control.\n","modified":"2026-07-10T19:16:57.783039362Z","published":"2026-07-10T18:38:15Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-009705","import_time":"2026-07-10T19:02:48.657700816Z","modified_time":"2026-07-10T18:38:15Z","sha256":"bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/paysafe-vault/v/1.0.0"}],"affected":[{"package":{"name":"paysafe-vault","ecosystem":"npm","purl":"pkg:npm/paysafe-vault"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"b96163b1b2e9a52777600fe059b18429ad5e9c003d45f3d7b6ac78cd8a631b193e6c3c","path":"index.js","sha256":"4a4b5c1bc1e948c853cb0978c07c7b8d1540c7b1ded95f8d5ad25c126cb6c7b0"}],"package_integrity":[{"filename":"paysafe-vault-1.0.0.tgz","hashes":{"sha1":"5a7ed14d886abbcb606ac358a0ee8cac470fb62d","sha512_sri":"sha512-PAj+ZrtqHJIOOdTumHjzM4wW5hfYjPIhYzwioy/GaWlhQaYs+kLremXdzZhm94rG6JzJK6oIn2bD8w06ADiMvA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/paysafe-vault/MAL-2026-10173.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}