- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 923
The attackers have created an ideal double for a popular financial instrument.
The ReversingLabs team discovered a malicious package in the NuGet repository that was disguised as a library Stripe.net and he tried to intercept access keys to the Stripe payment platform. The case showed that the attackers, who previously focused mainly on crypto projects, are switching to tools related to financial services.
Stripe.net — the official package for .NET, which helps applications work with the Stripe API and has long been the standard choice for online payment integration. Compromising such a component in the supply chain could lead to leakage of API keys and customer data, and in the worst case scenario, access to Stripe accounts and manipulation of transactions.
Instead of attacking the official package, the attackers chose typesquatting and published a similar name. StripeApi.Net . The package page looked as plausible as possible: the same icon, almost identical description and tags, links leading to Stripe resources, and the owner was called StripePayments. One of the few visual differences turned out to be the standard NuGet profile avatar, whereas the official package uses a corporate logo.
ReversingLabs also notes an attempt to create the illusion of popularity. The package was credited with more than 180,000 downloads, but they were distributed over 506 versions, with an average of several hundred per release, to make the statistics look more natural. There were DLL files inside, repeating the legitimate code. Stripe.net but with changes in key methods. When initializing the client, the library intercepted the API token and transmitted it along with the machine ID to a legitimate Supabase server, which the attackers used as an infrastructure for data collection. The NuGet platform has already encountered similar schemes before.
According to ReversingLabs, the actual damage could be minimal. The package was published around February 16, then quickly began to "update", and after notification, the NuGet administration deleted the find. When checking the Supabase database, no traces of stolen tokens were found, except for the test record, so compromising real projects looks unlikely.
The incident has once again exposed the risk of dependence on third-party libraries. Fake packages often retain their working functionality, so the build is error-free and payments continue to be processed, while the leak goes on in parallel and unnoticed. ReversingLabs also mentioned that such campaigns affect not only NuGet, and recalled outbreaks of malicious packages in other ecosystems, including npm.
The ReversingLabs team discovered a malicious package in the NuGet repository that was disguised as a library Stripe.net and he tried to intercept access keys to the Stripe payment platform. The case showed that the attackers, who previously focused mainly on crypto projects, are switching to tools related to financial services.
Stripe.net — the official package for .NET, which helps applications work with the Stripe API and has long been the standard choice for online payment integration. Compromising such a component in the supply chain could lead to leakage of API keys and customer data, and in the worst case scenario, access to Stripe accounts and manipulation of transactions.
Instead of attacking the official package, the attackers chose typesquatting and published a similar name. StripeApi.Net . The package page looked as plausible as possible: the same icon, almost identical description and tags, links leading to Stripe resources, and the owner was called StripePayments. One of the few visual differences turned out to be the standard NuGet profile avatar, whereas the official package uses a corporate logo.
ReversingLabs also notes an attempt to create the illusion of popularity. The package was credited with more than 180,000 downloads, but they were distributed over 506 versions, with an average of several hundred per release, to make the statistics look more natural. There were DLL files inside, repeating the legitimate code. Stripe.net but with changes in key methods. When initializing the client, the library intercepted the API token and transmitted it along with the machine ID to a legitimate Supabase server, which the attackers used as an infrastructure for data collection. The NuGet platform has already encountered similar schemes before.
According to ReversingLabs, the actual damage could be minimal. The package was published around February 16, then quickly began to "update", and after notification, the NuGet administration deleted the find. When checking the Supabase database, no traces of stolen tokens were found, except for the test record, so compromising real projects looks unlikely.
The incident has once again exposed the risk of dependence on third-party libraries. Fake packages often retain their working functionality, so the build is error-free and payments continue to be processed, while the leak goes on in parallel and unnoticed. ReversingLabs also mentioned that such campaigns affect not only NuGet, and recalled outbreaks of malicious packages in other ecosystems, including npm.
