---
id: 2526
title: "XRP supply chain attack: Official NPM package infected with crypto stealing backdoor"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor"
published_at: "2025-04-22 00:00"
tags: ["supply-chain", "cryptocurrency", "npm", "aikido", "backdoor", "supply-chain-attack", "private-keys", "aikido-intel", "xrpl", "npm-malware", "wallet-keys"]
phying_url: "https://phying.com/item/2526"
lang: en
---

# XRP supply chain attack: Official NPM package infected with crypto stealing backdoor

## Summary

The official xrpl npm package, XRP Ledger's SDK with 140,000 weekly downloads, was backdoored via unauthorized releases to steal wallet private keys whenever a Wallet object was instantiated.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2025-04-22 00:00
- **Original:** https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor
- **Phying News:** https://phying.com/item/2526