Malicious Package Affecting paypalmerchant.sdk package, versions [45.40.9][45.51.0][3.40.0][3.40.6][3.40.2][3.40.19][45.41.0][3.40.23][3.40.3][3.40.7][45.40.6][3.40.14][3.40.18][3.40.16][3.40.28][3.40.1][3.40.15][3.40.9][2.16.250][3.40.10][3.40.8][45.40.7][45.40.8][3.40.17][3.40.22][3.40.11][3.40.13][45.51.1][3.40.20][3.40.30][3.40.5][3.40.12][3.40.21][3.40.29][3.40.4][3.40.24][3.40.27][3.40.26][3.40.25]
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DOTNET-PAYPALMERCHANTSDK-18138068
- published22 Jul 2026
- disclosed20 Jul 2026
- creditUnknown
Introduced: 20 Jul 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the PayPalMerchant.SDK package.
Overview
PayPalMerchant.SDK is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.