xrpl.js npm supply-chain backdoor (2025-04-21): five malicious xrpl versions sent XRPL secret keys to 0x9c[.]xyz
- Scam type: Hack
- Project or site name: xrpl.js (npm package xrpl)
- Incident date: 2025-04-21
- Reported: 2026-10-24
- Last updated: 2026-10-24
On 2025-04-21 an attacker used the npm credentials of a phished Ripple employee who maintains xrpl.js to publish five malicious versions of the npm package xrpl: 4.2.1, 4.2.2, 4.2.3, 2.14.2 and 4.2.4, between 20:46 and 21:49 UTC (3:46 to 4:49 PM CT). The injected code captured XRPL secret key material and sent it to the attacker's server (XRPL disclosure report, https://xrpl.org/blog/2025/vulnerabilitydisclosurereport-bug-apr2025). The flaw is CVE-2025-32965 (GitHub advisory GHSA-33qr-m49q-rxfx, https://github.com/XRPLF/xrpl.js/security/advisories/GHSA-33qr-m49q-rxfx). Fixed versions are…