Blockchain security researcher from Alkido identified a serious vulnerability in the xrpl npm package v4.2.1-4.2.4 and v2.14.2.
This package is used by hundreds of thousands of applications and websites that steal private keys as soon as a Wallet object is instantiated.
On April 22, the XRP Ledger Foundation issued an urgent security warning regarding a critical vulnerability in its official JavaScript library, xrpl.js, that developers use to interact with the XRP Ledger blockchain. The vulnerability was identified as a sophisticated supply chain attack, in which malware code was inserted in some versions of the xrpl.js package that can undermine the security of cryptocurrency wallets utilizing this library. Aikido Intel, Aikido’s public threat feed that uses LLMs to monitor the public package managers, discovered the vulnerability.
The affected versions of xrpl.js, specifically v4.2.1 through v4.2.4 and v2.14.2, contained a backdoor function named checkValidityOfSeed. The fun
