“This package is used by hundreds of thousands of applications and websites, making it a potentially catastrophic supply chain attack on the cryptocurrency ecosystem,” warned Charlie Eriksen, a malware researcher at Aikido Security. The official XRPL (Ripple) NPM package, which serves as the JavaScript SDK for the XRP Ledger, was compromised with malicious code designed to steal cryptocurrency private keys, potentially affecting hundreds of thousands of applications. On April 21, 2025, at 20:53 GMT, Aikido Intel’s security monitoring system detected five unusual new package versions of the xrpl library, which averages more than 140,000 weekly downloads. Financial institutions and cryptocurrency service providers should also conduct thorough security audits of their dependencies to ensure they haven’t been affected by this or similar supply chain attacks. Further investigation confirmed that these versions contained backdoor code capable of stealing cryptocurrency private keys and gaining unauthorized access to users’ digital wallets. The security team quickly identified that a user named “mukulljangid” had released the suspicious package versions. Security experts estimate that the malicious package versions were downloaded approximately 450 times before being detected and removed. Organizations and developers working with XRP are advised to immediately update to the latest package versions and assume that any seed or private key processed by the compromised versions has been exposed. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 23 Apr 2025 15:45:08 +0000