A sophisticated, malicious Python package named “disgrasya” has been discovered on the PyPI repository, containing a fully automated carding script targeting WooCommerce stores.This package, whose name translates to “disaster” in Filipino slang, enables attackers to test stolen credit card information against real e-commerce payment systems with minimal technical expertise required. The malicious code executes a stealth attack by emulating legitimate customer checkout behavior, making it particularly difficult for fraud detection systems to identify and block. Unlike typical supply chain attacks relying on typosquatting or deceptive naming, “disgrasya” made no attempt to disguise its malicious nature. Instead, it openly served as a distribution mechanism for fraudsters seeking to validate stolen credit card information.
The package specifically targets merchants using WooCommerce with CyberSource as their payment gateway, creating a specialized attack vector against these widely-used e-commerce systems.Socket.dev researchers identified that the package had been downloaded over 34,860 times before discovery, indicating widespread distribution among potential attackers. The malicious payload first appeared in version 7.36.9, with all subsequent versions carrying the same embedded attack logic. This substantial download count suggests the tool may already be in active use across numerous fraud campaigns.The carding attack facilitated by this package represents a growing financial threat to businesses. Industry research estimates online payment fraud will cost merchants over $362 billion globally between 2025 and 2028, with annual losses nearly doubling from $38 billion in 2025 to $91 billion by 2028—a 140% increase.
Growing Financial Threat to E-Commerce
The discovery of the “disgrasya” package underscores the growing financial threat that automated carding attacks pose to e-commerce businesses. With the rapid increase in online shopping, the potential for cybercriminal activities has exponentially risen, leading to significant financial implications.Industry research indicates that online payment fraud will cost merchants over $362 billion globally between 2025 and 2028. This alarming statistic reflects the increasing sophistication and frequency of such attacks, which are expected to cause annual losses to nearly double from $38 billion in 2025 to $91 billion by 2028—a 140% increase.The prevalence of automated carding scripts like “disgrasya” highlights the need for robust security measures to protect against such threats. E-commerce platforms and payment gateways must prioritize improving their fraud detection systems to identify and mitigate the risk of automated attacks effectively. Implementing multi-layered security protocols, such as two-factor authentication and advanced machine learning algorithms, can play a crucial role in enhancing the defenses against these malicious activities. Additionally, regularly updating software and conducting thorough security audits can help identify and address vulnerabilities before they can be exploited by cybercriminals.Collaborative efforts among cybersecurity experts, e-commerce platforms, and payment gateway providers are essential in combating automated carding attacks. By sharing threat intelligence and best practices, the industry can stay one step ahead of cybercriminals and better protect online transactions. Furthermore, educating consumers about the risks associated with online shopping and promoting safe browsing habits can also contribute to reducing the impact of these attacks.Raising awareness about the importance of secure transactions and encouraging the use of virtual credit cards or secure payment methods can empower consumers to take an active role in safeguarding their financial information.
Future Considerations for E-Commerce Security
A sophisticated and malicious Python package named “disgrasya” has been discovered on the PyPI repository. This package features an automated carding script that targets WooCommerce stores. Translating to “disaster” in Filipino slang, “disgrasya” allows attackers to test stolen credit card details against real e-commerce payment systems with minimal technical know-how. The script emulates legitimate customer checkout actions, making it hard for fraud detection systems to uncover. Unlike typical supply chain attacks that rely on typosquatting or misleading names, “disgrasya” made no secret of its malicious intent; it openly served as a fraud distribution tool.Targeting WooCommerce merchants who use CyberSource as their payment gateway, it created a niche but effective attack vector. Researchers at Socket.dev found that the package had over 34,860 downloads before it was uncovered, showing that it had a broad reach among potential fraudsters. The malicious payload first surfaced in version 7.36.9, and subsequent versions all contained the same suspicious code. This significant download number suggests the tool might already be active in numerous fraud campaigns.Online payment fraud is a growing threat, with research predicting that it will cost merchants more than $362 billion globally between 2025 and 2028. Annual losses are expected to nearly double from $38 billion in 2025 to $91 billion by 2028, marking a 140% increase.