Fake packages impersonate well-known payment libraries

Researchers at Socket have identified a malicious campaign targeting developers through typosquatted packages published on both npm and PyPI. The packages impersonate popular payment software development kits used by organisations integrating online payment services. Developers who accidentally install them risk exposing credentials and sensitive payment information, or introducing malware into their development environments. The campaign shows that supply chain attacks relying on small naming differences continue to work. Organisations should verify package names before installation, use trusted dependency management practices and review projects for unexpected dependencies.

What this means for your organisation

Targeting payment libraries is not incidental. That is where development touches card data and payment credentials, and where a compromise carries direct financial and regulatory consequences. A misspelled package in a build pipeline reaches production without anyone necessarily reading the name again. This is a control that belongs in the toolchain, not in a developer's attention on a busy afternoon.

Berigo recommends

• Set up an internal package mirror or allowlist so developers do not pull directly from public registries.
• Require lock files and checksums in the build process so a dependency cannot change content unnoticed.
• Introduce automated dependency scanning in the build chain, with builds failing on findings.
• Review your projects for dependencies nobody can account for, and remove them.

Source

• socket.dev