{"id":"MAL-2026-10538","summary":"Malicious code in neteller (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c)\nPackage name and description impersonate the Paysafe-owned Neteller payment brand, with a fake repository URL 'github.com/paysafe/neteller'. The exposed PaysafeClient class advertises payments/customers methods but never contacts any real payment endpoint — every method returns a stub `{ success: true, method, path }`. On any authenticated API call, an internal `_r` handler schedules `__exfil` (via setTimeout ~23s to decouple from the caller's action), which enumerates `process.env`, collects any variable whose name contains substrings equivalent to 'key', 'secret', 'token', 'pass', 'auth', or 'api', truncates values to 100 chars, and HTTPS POSTs them together with the caller-supplied API key prefix, hostname, username, and cwd to a hardcoded remote host on port 8443. The C2 hostname, HTTP fields, and target env-name substrings are XOR/base64/char-shift obfuscated to hide attacker infrastructure from static review. An anti-analysis gate (`__check`) inspects `os.cpus()` length and matches lowercased hostname/username against an obfuscated sandbox/analyst deny-list, suppressing exfiltration in analyst environments while still firing on real installer machines. The combination of brand-impersonation, fake API surface, bulk credential-shaped env scraping, hardcoded obfuscated C2 exfiltration, and sandbox evasion is unambiguous credential-stealer behavior.\n","modified":"2026-07-14T04:46:57.977038948Z","published":"2026-07-14T03:38:17Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010378","import_time":"2026-07-14T04:31:59.856364875Z","modified_time":"2026-07-14T03:38:17Z","sha256":"167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/neteller/v/1.0.0"}],"affected":[{"package":{"name":"neteller","ecosystem":"npm","purl":"pkg:npm/neteller"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"neteller-1.0.0.tgz","hashes":{"sha512_sri":"sha512-s1xQBsC4eOwxJlJRaqQ/vIZb5Z2ga9INbCZt/UBtC4OBfbs6gxOEHmlp91nvR0LXgOmagPRMkoynrulhPl0UVA==","sha1":"3715cc8cbb027d7286584ab6912e27816417fc85"}}],"evidence_files":[{"path":"package.json","sha256":"bab9122af6990cf61e77b48a4f2077ecfdde641f9537958969c3482073a88c9e","tlsh":"2fe02227eb609d2b12b917534824c1a2b3224f1f50644c0b30fb002e83639730efab18"},{"path":"index.js","sha256":"9fd06d823d54183cc91625fdc6decffe8db2863f6499a955656ebdcc089792cf","tlsh":"9f618130b2a9293bbba04fe95cb144118d9e4c003e41f387bb6c38cd9e531d196e683c"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/neteller/MAL-2026-10538.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}