Massive Supply Chain Attack Hits XRPL NPM Package, Puts Crypto Wallets at Risk
A major supply chain attack has shaken the cryptocurrency development community. The official XRPL (Ripple) NPM package — a widely used JavaScript SDK for interacting with the XRP Ledger — was found to be compromised with malicious code designed to steal users’ private cryptocurrency keys. This security breach could potentially impact hundreds of thousands of applications.
The incident was first detected on April 21, 2025, at 20:53 GMT, when Aikido Intel’s threat monitoring system flagged five suspicious new versions of the xrpl library. With over 140,000 downloads per week, the package is a critical dependency in many crypto-related projects.
Upon closer analysis, these rogue versions were confirmed to contain a backdoor — malware specifically engineered to extract private keys and gain unauthorized access to digital wallets.
“This package powers hundreds of thousands of applications and websites,” said Charlie Eriksen, malware researcher at Aikido Security. “Its compromise represents a potentially catastrophic supply chain attack on the cryptocurrency ecosystem.”
The investigation quickly traced the malicious uploads to an NPM account under the name mukulljangid. According to initial findings, this account likely belonged to a Ripple employee whose credentials were compromised, allowing the attacker to publish rogue package versions.
The affected versions — 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2 — immediately raised suspicion as they didn’t match any official releases on the project’s GitHub repository. This mismatch was one of the earliest signs that something was seriously wrong.
Technical Deep Dive: How the XRPL NPM Package Was Compromised
Upon closer analysis, researchers uncovered a malicious function called checkValidityOfSeed hidden within the compromised XRPL package. This function was engineered to exfiltrate users’ private key information to a suspicious domain — 0x9c[.]xyz — which had only been registered in January 2025, suggesting premeditated intent.
The backdoor activated whenever users created or interacted with XRP wallets, silently transmitting sensitive cryptographic data to the attacker.
“The attacker was actively experimenting with different ways to insert the backdoor while avoiding detection,” said Charlie Eriksen, malware researcher at Aikido Security. “They started by manually embedding it in the compiled JavaScript, and later moved the payload into the TypeScript source before compiling it down — a clear effort to stay under the radar.”
Fortunately, the XRP Ledger Foundation confirmed that this breach was isolated to the xrpl.js NPM package and did not impact the XRP Ledger core codebase or its GitHub repository.
As soon as the threat was identified, the maintainers responded swiftly by releasing clean versions — 4.2.5 and 2.14.3 — to replace the compromised packages.
According to security experts, the tainted versions were downloaded roughly 450 times before being removed from the NPM registry. Developers who installed any affected versions between April 21 and April 22, 2025, are strongly advised to inspect their logs for any outbound traffic to 0x9c[.]xyz.
This breach underscores the increasing frequency and sophistication of software supply chain attacks, particularly within the cryptocurrency ecosystem. The attack bears similarities to the 2021 compromise of UAParser.js, a widely-used package that was hijacked and republished with malicious code.
What You Should Do:
- Immediately upgrade to
xrpl.jsversion 4.2.5 (or 2.14.3). - Revoke and replace any private keys that were handled using the compromised versions.
- Review application logs and network activity for suspicious behavior, particularly traffic to
0x9c[.]xyz. - Conduct a full audit of dependencies if you’re building or managing crypto-related software.
This incident is a stark reminder of how even trusted software dependencies can become attack vectors. Vigilance, rapid incident response, and proactive monitoring are essential to securing modern crypto infrastructure.
