Malicious npm Package Disguised as Advcash Integration Triggers Reverse Shell

stapp · Apr 15, 2025

What if clicking “Pay” didn’t just confirm a transaction but handed over your server access to an attacker?

The Socket Threat Research has discovered an npm package, @naderabdi/merchant-advcash, designed to do exactly this. The open source package quietly bundles a reverse shell inside a payment success callback. The module posed as a merchant integration for Advcash, a lesser-known digital payment platform often used in gray-market crypto exchanges, offshore financial services, and certain high-risk e-commerce operations. The service rebranded to Volet last year and is not available to users located in the U.S.
Click to expand...

https://socket.dev/blog/npm-package-advcash-integration-triggers-reverse-shell

Log in or Sign up

Malicious npm Package Disguised as Advcash Integration Triggers Reverse Shell

stapp Global Moderator

Log in or Sign up

Malicious npm Package Disguised as Advcash Integration Triggers Reverse Shell

stapp Global Moderator

Useful Searches