cryptd.in

암호화폐 친화적인 인재를 위한 대체 링크드인

XRP Ledger SDK Compromised by Backdoor Exploit

-

by

cryptd.in
in

The XRP Ledger Foundation has warned about a security vulnerability in the official JavaScript SDK, which interacts with the XRPL.

On April 21, Aikido Security revealed that several versions of its Node Package Manager (NPM) software were compromised and published, containing a backdoor that could steal private keys from users.

Security Flaw in Developer Kit

The XRP Ledger Foundation confirmed the issue in an April 22 statement:

“Earlier today, a security researcher from @AikidoSecurity identified a serious vulnerability in the xrpl npm package (v4.2.1-4.2.4 and v2.14.2).”

In response to the breach, Wietse Wind, founder and CEO of XRPL Labs, reassured users that Xaman Wallet was not affected by the flaw. Wind explained that the product does not use xrpl.js but instead relies on its xrpl-client and xrpl-accountlib libraries, which separate wallet connectivity from the signing process.

He also detailed how the incident unfolded, stating that malicious code in the xrpl.js package sent generated or imported private keys to an external server controlled by the attacker. This enabled hackers to collect key pairs, wait for the wallets to be funded, and then steal the assets.

Wind urged anyone who had recently created an XRP wallet using the API or related tools to assume it had been compromised and to transfer their funds immediately.

He emphasized that such attacks can happen to any software relying on third-party libraries, and that developers must take precautions. He also advised limiting publishing access, scanning code before release, avoiding auto-publishing pipelines, and not managing private keys directly unless fully prepared to handle the associated risks.

XRPL Issues Urgent Patch

Following the incident, the XRP Ledger Foundation has released a clean version of the NPM package, removing the malicious code and ensuring the SDK is safe for developers to use again.

Aikido Security discovered the vulnerability after its automated threat monitoring system flagged suspicious updates to the XRPL package on NPM. These updates, published by a user named “mukulljangid”, included five new versions that did not match any official releases on the XRP Ledger’s GitHub repository.

After investigating, Aikido found that the compromised versions contained a malicious function called checkValidityOfSeed, which sent private keys to the hacker’s server at 0x9c[.]xyz, when users created a wallet that could allow them to steal their crypto.

Early versions (v4.2.1 and v4.2.2) hid the backdoor in compiled JavaScript files, while later versions (v4.2.3 and v4.2.4) embedded the malicious code directly in TypeScript source files, making it harder to detect. The compromised packages also removed development tools like Prettier and build scripts from the package.json file, showing intentional manipulation.

The incident comes only weeks after Ripple announced a $1.25 billion acquisition of prime brokerage firm Hidden Road, a move experts believe will turn XRPL into a major conduit for institutional funds.

According to Ripple CEO Brad Garlinghouse, the network will be used for post-trade settlements on some transactions, potentially turning it into a corporate-scale clearing and credit platform.

게시물 XRP Ledger SDK Compromised by Backdoor Exploit 에 처음 등장 크립토포테이토.

댓글

답글 남기기

이메일 주소는 공개되지 않습니다. 필수 필드는 *로 표시됩니다

최신 피드

인기 카테고리

ko_KR 한국어
ko_KR 한국어 en_US English ro_RO Română et Eesti ja 日本語 ru_RU Русский de_DE Deutsch es_ES Español zh_CN 简体中文 fr_FR Français zh_TW 繁體中文 pt_PT Português it_IT Italiano pl_PL Polski tr_TR Türkçe nl_NL Nederlands id_ID Bahasa Indonesia el Ελληνικά uk Українська bg_BG Български cs_CZ Čeština fi Suomi hu_HU Magyar lv Latviešu valoda lt_LT Lietuvių kalba nb_NO Norsk bokmål sk_SK Slovenčina sl_SI Slovenščina sv_SE Svenska

웹사이트 검색

인기 스토리

태그

#AlexeyPertsev (1) #BidenCryptoBan (1) #BidenElection (1) #BinanceVsCoinbase (1) #B비트코인 (458) #BitcoinETF (3) #B비트코인기초 (1) #B비트코인 취급 (1) #B비트코인가격 (5) #B비트코인가격수준 (1) #B비트코인펌프 (1) #B비트코인예치 (1) #B비트코인서지 (1) #BitcoinTop (1) #Bitfinex (1) #B비트 단위 (1) #브레이스브리지캐피털 (1) #BRC20토큰 (1) #BTC취득 (1) #B울리스틱 예측 (1) #BullishSentiment (1) #C중국광업 (1) #CPIP리뷰 (1) #CryptoAsset (2) #CryptoBattle (1) #CryptoBoom (1) #CryptoExpert (1) #CryptoInsights (1) #CryptoMania (1) #CryptoMarket (4) #CryptoPrediction (1) #CryptoPredictions (1) #CryptoRegulation (2) #CryptoTakeoff (1) #CryptoTiming (1) #CryptoTips (1) #CryptoTreasury (1) #CryptoUncertainty (1) #DerivativeJump (1) #Dogecoin (74) #DogecoinGains (1) #DogecoinVolume (1) #DutchCourt (2) #ECommerce (1) 1TP5테엘살바도르비트코인 (1) 1TP5테더리움 (74) 1TP5테더리움통증 (1) 1TP5테더리움가격 (1) 1TP5전문가 의견 (1) #FedRateCut (1) #FiatCurrency (1) #FinancialImpact (1) #FinancialPrivacy (1) #FirmShutdown (1) #FrozenAccounts (1) #IllicitFunds (1) #인플레이션데이터 (1) #투자 (1) #투자손실 (1) #일본기업 (1) #LegalAction (1) #LegalImpact (1) #법률 (1) #라이트닝 네트워크 (1) 1TP5시장분석 (3) 1TP5시장 모니터링 (1) 1TP5시장 예측 (1) 1TP5시장 예측 (1) #MarketProjection (1) 1TP5마켓지원 (1) 1TP5시장변동성 (1) #M결혼 (1) #MemeCoin (5) #MemeCoins (2) #M광부수익성 (1) #MoneyLaundering (2) #MtGox (4) 1TP5북한암호화 (1) 1TP5노보그라츠예측 (1) #P가격 마일스톤 (1) #P가격 예측 (2) #P가격 질문 (1) #PriceSurge (1) #P형량 (1) #QuantAnalysis (1) 1TP5규제압력 (1) #SEC안티크립토 (1) #ShibaInu (6) #SocialBuzz (1) 1TP5기술분석 (1) #Toncoin (3) #TornadoCash (3) #TornadoCashDev (1) 1TP5토네이도캐시개발자 (1) #UKCrypto (1) #업사이드 잠재력 (1) #USCongress (1) #와이오밍랜드 (1) #XRP가격 (1) #XRP업스윙 (1)

유용한 링크

유용하다고 생각되어 공유하고 싶은 링크.