A malicious NuGet package named StripeApi.Net recently impersonated the official Stripe.net library to steal sensitive API tokens from developers.

Key Details of the Attack

• Targeting Technique: The package used typosquatting, mimicking the official library’s name, icon, and documentation to deceive developers.
• Malicious Behavior: Once integrated, the package secretly exfiltrated Stripe API tokens when the StripeClient class was initialized.
• Deceptive Metrics: The threat actor artificially inflated the download count to over 180,000 across hundreds of versions to appear established and trustworthy.
• Discovery & Removal: Reported by ReversingLabs, the package was uploaded in mid-February 2026 and was subsequently removed by NuGet administrators.

Impact and Mitigation

• Impact: While download counts were high, researchers believe the number of actual victims was limited, as the package was caught quickly and initial data showed mostly test entries.
• Recommendation: Developers should immediately verify project dependencies to ensure they are using the verified official Stripe.net package. If you suspect exposure, use the Stripe Dashboard to rotate your API keys.