MAL-2026-10538

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/neteller/MAL-2026-10538.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10538
Published
2026-07-14T03:38:17Z
Modified
2026-07-14T04:46:57Z
Summary
Malicious code in neteller (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c)

Package name and description impersonate the Paysafe-owned Neteller payment brand, with a fake repository URL 'github.com/paysafe/neteller'. The exposed PaysafeClient class advertises payments/customers methods but never contacts any real payment endpoint — every method returns a stub { success: true, method, path }. On any authenticated API call, an internal _r handler schedules __exfil (via setTimeout ~23s to decouple from the caller's action), which enumerates process.env, collects any variable whose name contains substrings equivalent to 'key', 'secret', 'token', 'pass', 'auth', or 'api', truncates values to 100 chars, and HTTPS POSTs them together with the caller-supplied API key prefix, hostname, username, and cwd to a hardcoded remote host on port 8443. The C2 hostname, HTTP fields, and target env-name substrings are XOR/base64/char-shift obfuscated to hide attacker infrastructure from static review. An anti-analysis gate (__check) inspects os.cpus() length and matches lowercased hostname/username against an obfuscated sandbox/analyst deny-list, suppressing exfiltration in analyst environments while still firing on real installer machines. The combination of brand-impersonation, fake API surface, bulk credential-shaped env scraping, hardcoded obfuscated C2 exfiltration, and sandbox evasion is unambiguous credential-stealer behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010378",
            "import_time": "2026-07-14T04:31:59.856364875Z",
            "modified_time": "2026-07-14T03:38:17Z",
            "sha256": "167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / neteller

Package

Name
neteller
View open source insights on deps.dev
Purl
pkg:npm/neteller

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "bab9122af6990cf61e77b48a4f2077ecfdde641f9537958969c3482073a88c9e",
            "tlsh": "2fe02227eb609d2b12b917534824c1a2b3224f1f50644c0b30fb002e83639730efab18"
        },
        {
            "path": "index.js",
            "sha256": "9fd06d823d54183cc91625fdc6decffe8db2863f6499a955656ebdcc089792cf",
            "tlsh": "9f618130b2a9293bbba04fe95cb144118d9e4c003e41f387bb6c38cd9e531d196e683c"
        }
    ],
    "package_integrity": [
        {
            "filename": "neteller-1.0.0.tgz",
            "hashes": {
                "sha1": "3715cc8cbb027d7286584ab6912e27816417fc85",
                "sha512_sri": "sha512-s1xQBsC4eOwxJlJRaqQ/vIZb5Z2ga9INbCZt/UBtC4OBfbs6gxOEHmlp91nvR0LXgOmagPRMkoynrulhPl0UVA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/neteller/MAL-2026-10538.json"