--- title: "Masquerading payment npm package installs backdoor" url: https://daily.dev/posts/masquerading-payment-npm-package-installs-backdoor-d1rdq2hqp source_url: https://www.developer-tech.com/news/masquerading-payment-npm-package-installs-backdoor/ type: article source: "Developer Tech" author: "Ryan Daws" published: 2025-04-15T14:54:26.509Z updated: 2026-03-15T07:33:06.888Z tags: ["cyber", "fintech", "javascript", "malware", "npm"] reading_time: 2 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Masquerading payment npm package installs backdoor **[Developer Tech](https://daily.dev/sources/developertech)** · [@gadget_ry](https://daily.dev/gadget_ry) · 2 min read · 0 upvotes · 0 comments ## Summary Cybersecurity researchers at Socket have discovered a malicious npm package, @naderabdi/merchant-advcash, that hijacks server control during payment transactions. The package, designed to look like a legitimate integration for the Advcash payment platform, activates a reverse shell upon successful payment, allowing attackers to remotely control systems. The sophistication of the module, including its delayed activation and minimal footprint, helps it evade static analysis tools. Developers are reminded to be cautious and not blindly trust external packages. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#fintech](https://daily.dev/tags/fintech), [#javascript](https://daily.dev/tags/javascript), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/masquerading-payment-npm-package-installs-backdoor-d1rdq2hqp)