Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
A fake Sicoob NuGet SDK stole client IDs and PFX certificates, while 14 npm packages were used to grab cloud and CI/CD secrets.
Intelligence analysis by GPT-5.4 Mini
Security researchers found a malicious NuGet package posing as a Sicoob SDK and a separate set of npm packages built to harvest developer secrets. The attacks show supply-chain abuse spreading across package ecosystems, from banking credentials to cloud access tokens.
A bad package pretended to be a tool for a bank system. When someone used it, it secretly copied important files and passwords and sent them away.
That is like buying a toolbox and finding out one of the tools is really a tiny spy camera. The box looks normal, but it hides a trick inside.
The same report also found fake software packages for programmers that tried to steal cloud keys and other secret codes. Those keys can let thieves open a lot of doors later.
Analysis
NuGet abuse
Socket says versions 2.0.0 through 2.0.4 of Sicoob.Sdk were malicious and posed as a C# SDK for Sicoob, one of Brazil's largest cooperative financial systems. When a developer instantiated SicoobClient with a client ID, PFX path, and PFX password, the package read the certificate from disk, Base64-encoded it, and sent the client ID, password, and certificate data to a hardcoded third-party Sentry endpoint. The package also captured raw Boleto API responses through a separate Sentry path, which could expose payment details, identifiers, amounts, dates, and payer or payee data.
The stolen material is sensitive because PFX certificates authenticate businesses to the Sicoob banking network for automated operations such as instant payments and dynamic Pix QR code generation. Socket says the package was downloaded nearly 500 times, and NuGet blocked it after responsible disclosure. The profile behind the package, sicoob, also listed 11 other NuGet packages that together had about 6,000 downloads. Socket said Google Search AI Mode surfaced the package as if it were a legitimate C# library, increasing the chance that developers would install it.
npm packages
The same report set also includes 14 malicious npm packages that typosquat OpenSearch, ElasticSearch, DevOps, and environment-configuration libraries. Microsoft Defender Security Research Team says they were published by a threat actor using the name vpmdhaj on May 28, 2026, and used a preinstall hook to launch a credential harvester that sought AWS credentials, HashiCorp Vault tokens, npm tokens, and CI/CD secrets. The broader context is a wave of npm abuse: packages that exfiltrate process.env, a proxy campaign, keylogging and screenshot theft, and dependency-confusion attacks with a fake high version number. The article's remediation advice is to remove Sicoob.Sdk, treat PFX material as compromised, replace exposed certificates, rotate passwords, change or disable affected client IDs, and review Sicoob auth and API logs for unusual activity.
Key points
- Socket found malicious `Sicoob.Sdk` NuGet versions 2.0.0 through 2.0.4 stealing client IDs and PFX certificates.
- The package sent stolen data to a hardcoded third-party Sentry endpoint and could expose Boleto API responses.
- NuGet blocked the package after disclosure, and the related profile listed 11 other NuGet packages with about 6,000 downloads.
- Microsoft Defender researchers identified 14 malicious npm packages designed to harvest AWS, Vault, npm, and CI/CD secrets.
- The article frames the incidents as part of a broader surge in supply-chain attacks across package ecosystems.
