Fake Braintree NuGet Package Steals Payment Data via Typosquatting
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers published a malicious NuGet package named 'Braintree.Net' designed to impersonate PayPal's official Braintree SDK, intercepting live payment card data (PAN, CVV, expiration dates) and harvesting merchant API credentials at runtime. The attackers artificially inflated download counts to ~14 million by publishing 120 empty placeholder versions, creating a false sense of legitimacy and making the package appear widely trusted. This attack exploits the inherent trust developers place in package repositories and the lack of rigorous verification before integrating third-party dependencies into payment-critical applications. The impact is severe: any merchant application that installed the malicious versions was effectively a live skimmer, exfiltrating sensitive cardholder data directly to attacker-controlled infrastructure, triggering potential PCI DSS breach obligations.
Tactical Insight
Immediate actions
- Audit all NuGet dependencies in payment-related projects and verify package names, publisher identity, and digital signatures against official sources.
- Remove any versions of Braintree.Net (3.35.8–3.36.1) immediately, rotate all exposed merchant API keys, and treat any processed payment card data as compromised.
- Block outbound traffic to known attacker infrastructure (api.348672-shakepay[.]com) at the perimeter firewall.
Long-term improvements
- Enforce a vetted, internal package mirror or allowlist so developers can only consume pre-approved, organization-approved NuGet packages.
- Integrate software composition analysis (SCA) tools (e.g., Sonatype, Snyk, GitHub Dependabot) into CI/CD pipelines to flag typosquatted or suspicious packages before they reach production.
- Establish a formal third-party dependency review process that validates publisher identity, repository provenance, and code integrity for all packages used in payment or credential-handling contexts.
Detection measures
- Monitor egress network traffic for anomalous outbound connections from application servers, especially to unknown or newly registered domains.
- Enable runtime application security monitoring (RASP) or behavioral analysis to detect unexpected data exfiltration patterns from payment processing services.
- Continuously scan production environments for known malicious package hashes using threat intelligence feeds integrated with your SIEM or CNAPP platform.