Supply chain · npm · High

Critical npm Package 'payoutsvettingserv-paypal' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-27

A critical malicious npm package, 'payoutsvettingserv-paypal', has been identified as fully compromising any system on which it is installed. This package poses a severe risk of credential and secret theft, necessitating immediate action for affected systems.

  • Package: npm / payoutsvettingserv-paypal
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~109/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'payoutsvettingserv-paypal' has been identified as malware. Any system that has installed or run this package is considered fully compromised, indicating a complete loss of control to an external entity.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. When developers integrate such a package into their projects, either directly or as a dependency, the malicious code executes during installation or runtime, leading to system compromise and potential data exfiltration, specifically credential/secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any developer or system administrator who has directly or indirectly installed 'payoutsvettingserv-paypal'

Conditions that increase exposure

  • Unpinned dependencies in package.json or similar configuration files
  • Lack of dependency lockfiles (e.g., package-lock.json) or not committing them to version control
  • Use of internal package mirrors that do not vet packages for known vulnerabilities or malicious content
  • Automated build processes that do not include dependency integrity checks

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to further network penetration.
  • All secrets and keys stored on the compromised computer are exposed and can be exfiltrated.
  • The attacker can establish persistence on the system, making simple package removal insufficient for remediation.

What to do (defensive)

Detect

  • Scan dependency trees for 'payoutsvettingserv-paypal' across all projects and environments.
  • Review build logs and package installation histories for any mention of the package.
  • Implement software composition analysis (SCA) tools to monitor for known malicious packages.

Contain

  • Immediately isolate any system identified as having installed or run 'payoutsvettingserv-paypal' from the network.
  • Block 'payoutsvettingserv-paypal' from being downloaded from package registries or internal mirrors.
  • Suspend all CI/CD pipelines that might be exposed to this package until remediation is complete.

Remediate

  • Consider any compromised system as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised system, performing this action from a different, trusted computer.
  • Force-update all dependencies to known good versions and pin them using lockfiles.
  • Implement strict dependency vetting processes, including integrity checks and source verification.

Frontier verdict — High

Prioritize immediate isolation and credential rotation for any system exposed to 'payoutsvettingserv-paypal' due to critical compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.