Critical Ripple xrpl.js npm Package Compromised in Major Cyber Attack

TL;DR

The Ripple cryptocurrency npm JavaScript library, xrpl.js, was compromised in a supply chain attack targeting private keys. Affected versions include 4.2.1 to 4.2.4 and 2.14.2. The issue has been resolved in versions 4.2.5 and 2.14.3.

Major Cyber Attack on Ripple’s xrpl.js npm Package

In a significant cybersecurity incident, the Ripple cryptocurrency npm JavaScript library named xrpl.js was compromised by unknown threat actors. This software supply chain attack was designed to harvest and exfiltrate users’ private keys, putting numerous cryptocurrency holders at risk.

Affected Versions and Resolution

The malicious activity targeted five different versions of the xrpl.js package:

• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 2.14.2

Ripple has addressed the issue in the subsequent releases:

• 4.2.5
• 2.14.3

Users are strongly advised to update to these patched versions immediately to safeguard their private keys and cryptocurrency assets.

For more details, visit the full article: source

Conclusion

The compromise of Ripple’s xrpl.js npm package underscores the critical importance of supply chain security in the cryptocurrency ecosystem. Users must remain vigilant and promptly update to the latest secure versions to protect their digital assets from such threats. Future implications include a heightened focus on security measures and potentially more robust auditing processes for open-source libraries.