Malicious NuGet Package Impersonated Stripe to Steal API Tokens

A typosquatted NuGet package impersonating the official Stripe payment library was caught exfiltrating API tokens from developers who installed it. The malicious package, named StripeApi.Net, functioned as a working payment integration—processing transactions normally while secretly copying sensitive credentials to attacker-controlled infrastructure.

ReversingLabs researchers discovered the supply chain attack targeting .NET developers integrating Stripe payments into their applications. The package was removed shortly after disclosure, likely preventing widespread compromise.

How the Attack Worked

The threat actor behind StripeApi.Net executed a near-perfect impersonation of the legitimate Stripe.net library, which has accumulated over 75 million downloads. The deception included:

• Identical iconography — Same visual branding as the official package
• Near-matching documentation — README content copied verbatim with only "Stripe.net" swapped to "Stripe-net"
• Inflated download counts — Artificially boosted to over 180,000 downloads across 506 versions
• Believable publisher name — Uploaded by user "StripePayments" on February 16, 2026

The per-version download average of approximately 300 was carefully calibrated to appear legitimate without triggering obvious anomaly detection.

What made this attack particularly insidious: it worked. Applications integrating StripeApi.Net would compile successfully, payments would process normally, and from a developer's perspective, nothing appeared broken. But in the background, the package captured Stripe API tokens—the credentials that authorize payment operations—and transmitted them to external servers.

The Financial Sector Supply Chain Problem

Payment integrations represent high-value targets for supply chain attacks. Stripe API keys grant access to:

• Customer payment methods and billing information
• Transaction processing capabilities
• Subscription and recurring billing controls
• Refund and payout authorization

Compromised credentials enable financial fraud at scale. Attackers can redirect payments, issue unauthorized refunds to accounts they control, or harvest payment card data from transaction flows.

This attack echoes patterns we've seen in other package ecosystems. The Lazarus group's recent npm and PyPI campaigns targeted cryptocurrency developers with similar typosquatting tactics, while malicious Chrome extensions have targeted business account credentials with comparable stealth. The Astaroth WhatsApp worm showed how financial sector targeting has become a primary focus for credential-stealing malware.

Detection and Response

ReversingLabs caught the package relatively quickly after its initial release, limiting damage. Their detection relied on behavioral analysis of package contents rather than signature matching—typosquatted packages often evade basic checks by appearing functionally legitimate.

The NuGet admin team removed the package promptly after notification. According to the researchers, the swift response makes it "unlikely that there were real victims compromised in this attack."

Still, the incident demonstrates how convincingly attackers can replicate trusted software. The 180,000 inflated download count alone might have persuaded some developers that the package was widely adopted and therefore safe.

Protecting Against Package Typosquatting

For development teams using NuGet or any package manager:

1. Verify publisher identity — Check the package owner against the vendor's official documentation
2. Compare package names exactly — Subtle variations like dashes vs. dots or pluralization are common typosquat techniques
3. Review dependency trees — Audit transitive dependencies, not just direct imports
4. Use lockfiles — Pin exact versions to prevent supply chain attacks via compromised updates
5. Implement package allowlisting — In high-security environments, restrict installation to pre-approved packages

Organizations processing payments should also implement API key rotation, monitoring for unauthorized usage, and least-privilege scoping for payment credentials. Stripe specifically offers restricted API keys that limit scope to specific operations—use them.

The Package Repository Trust Problem

Package ecosystems like NuGet, npm, and PyPI face a fundamental tension: ease of publishing enables rapid innovation but also lowers barriers for attackers. Current mitigations—download counts, verified publishers, community reviews—don't scale to catch sophisticated impersonation.

ReversingLabs' work demonstrates that automated behavioral analysis can catch malicious packages that human review would miss. But this capability isn't uniformly deployed across all repositories, and attackers continue finding gaps.

For security teams managing development environments, this incident reinforces the need for supply chain security tooling. The attack was caught before causing documented harm, but the next typosquat might not be discovered as quickly. For organizations looking to understand supply chain attack patterns more broadly, our coverage of previous malware campaigns tracks evolving techniques across package ecosystems.