PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

XRP supply chain attack: Official NPM package infected with crypto stealing backdoor

aikido.dev | incident | #supply-chain | #cryptocurrency | #npm | #aikido | #backdoor | #supply-chain-attack | #private-keys | #aikido-intel | #xrpl | #npm-malware | #wallet-keys
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The official xrpl npm package, XRP Ledger's SDK with 140,000 weekly downloads, was backdoored via unauthorized releases to steal wallet private keys whenever a Wallet object was instantiated.
Published
Collected

Related coverage

incident · wiz.io
Miasma: Supply Chain Attack Targeting RedHat npm Packages
Wiz Research found Miasma, a supply-chain attack on @redhat-cloud-services npm: 32+ tampered releases (~80k weekly downloads) carried a Shai-Hulud-derived payload targeting GCP and Azure identities.
incident · wiz.io
Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond
Wiz dissects the npm debug/chalk incident: releases live ~2 hours carried a wallet-hijacking browser interceptor into affected builds; telemetry quantifies ~99% prevalence and ~10% malware presence.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
blog · aikido.dev
eMudhra CA compromise: eight private keys, and one of them is 4
Aikido reports the compromise of certificate authority eMudhra: eight private keys were exposed, including one 4096-bit RSA key, raising concerns about potentially forged certificates.
blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
Back