Malicious Supply Chain Compromise in xrpl.js npm Package

This disclosure report contains technical details of the vulnerability of the XRP Ledger Javascript library package (xrpl.js) hosted at npmjs.com.

Date Reported: April 22, 2025

Affected Version(s): xrpl.js (xrpl in npmjs.com) versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

Summary of Vulnerability

On April 21st, 2025, several versions of xrpl.js were published with malicious code injected to surreptitiously capture secret key material and exfiltrate that material to an unknown attacker’s website.

This attack was discovered and reported in the early morning hours of April 22nd, 2025 UTC, and the incident was resolved by mid-afternoon on the same day UTC time when new versions of xrpl.js were published and all malicious package versions were deprecated in npmjs.com.

Impact

This vulnerability does not affect the XRP Ledger network or codebase, but is instead limited to the npm package called xrpl, which is the package name for the xrpl.js (a JavaScript library for interacting with the XRP Ledger).

Note: No GitHub repositories were compromised at any time as part of this incident. Instead, the attacker was able to publish malicious code directly into the npm registry system using compromised npm credentials. In particular, npm versions 2.14.2 and 4.2.1 - 4.2.4 of xrpl.js were compromised with malicious code designed to exfiltrate private key material.

As of today, no downstream effects have been reported. Those that have installed the infected versions should assume their wallets are compromised and follow the recommendations for key rotation.

Technical Details

Discovery

At 8:14 AM UTC on 22 Apr 2025, Ripple teams were alerted by a security researcher from Aikido Security about a breach in the xrpl package in the npmjs.com repository. The malicious package contained a function called checkValidityOfSeed, which triggers a call to the attacker’s domain to surreptitiously steal information used to assemble an XRPL private key.

Ripple and the XRPL Foundation began investigating the incident, and learned from the Aikido team that versions 4.2.1 through 4.2.4 (as well as 2.14.2) were impacted. As part of this discovery process, Ripple engineering teams verified that malicious code was initially implemented within the functions generate(algorithm = DEFAULT algorithm) and fromRFC1751Mnemonic(mnemonic, opts). This code was published in all cases directly into npm (bypassing all PR approval processes) using the same compromised user account.

In tandem, by noon UTC this incident became publicly known online, for example: this, this, this blog, and this reddit post. Later in the morning, the XRP Ledger Foundation issued a statement on X here, notifying applications and letting the community know that teams were working on a fix.

Root Cause

On 21 Apr 2025 at 20:39 UTC, a Ripple employee who helps maintain the affected package was phished for their credentials. This provided the threat actor access to the npm package repository for the xrpl library, and this access was abused to modify the javascript package code such that, when executed by downstream dependent software, XRPL private key material would be sent to the threat actor’s server.

In total, five malicious package versions were published for xrpl:

1. 4.2.1 - Published at 2025-04-21T20:46:24.710Z
2. 4.2.2 - Published at 2025-04-21T20:55:55.822Z
3. 4.2.3 - Published at 2025-04-21T21:32:24.445Z
4. 2.14.2 - Published at 2025-04-21T21:37:09.418Z
5. 4.2.4 - Published at 2025-04-21T21:49:35.179Z

A joint investigation team inside of Ripple confirmed that the phishing attack specifically targeted npm and no other platforms were affected.

Remediation

• Affected xrpl versions in npm have been identified and deprecated. We have reached out to npm for assistance with unpublishing them entirely.
• New versions of the affected packages have been published. See here.
• Improved User Security
  • The compromised user has been removed as a maintainer of all XRPL-related npm packages; the root cause of the user compromise has been identified and resolved.
  • Ripple and the XRPLF have enabled 2FA for all users in npmjs.com.
• XRPLF has been leading communications with the XRPL developer community via several different channels throughout the incident, with support from Ripple.
• Ripple is working with xrpl package dependents to ensure they’re not running impacted versions of their software released on npm during the window of compromise.
• The malicious website used by the attacker has been reported to the domain registrar.
• CVE Requested via Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2; accepted as CVE-2025-32965 with a score of 9.3; CVE Published to NIST Database.
• Advisory notifications sent to xrpl-announce.

Strategic Mitigation Initiatives

Ripple and XRPLF engineering teams are implementing a series of strategic prevention measures as part of an ongoing commitment to software supply chain security. These include strengthening the integrity of release processes through automation and verification enhancements, as well as expanding monitoring capabilities to detect anomalies in publishing workflows. The teams are also reviewing collaborator/publish access to ensure redundancy and remove single points of failure. These efforts will be rolled out in phases and are designed to proactively reduce risk and enhance trust in the open-source ecosystem.

Steps to Reproduce

This explainer video by @advocatemack provides an excellent summary of how the attacker executed this exploit.

Fixes / Patches Available

The fix for this issue is available in the xrpl package on npmjs.com, versions 4.2.5 and 2.14.3. All projects are advised to avoid versions 4.2.1 through 4.2.4, and also avoid 2.14.2.

Acknowledgements

Thanks to Aikido Security and Charlie Eriksen for discovering this compromise, and to the XRPLF for jumping into action to investigate and mitigate this vulnerability.

And, as always, thanks to the global community of validators, developers, and contributors who keep the XRP Ledger running and help keep the network safe and secure.

References

• xrpl.js Github Repository: https://github.com/xrplf/xrpl.js
• xrpl.js npm Package: [https://www.npmjs.com/package/xrpl]https://www.npmjs.com/package/xrpl()
• Attack Explainer Video: https://x.com/advocatemack/status/1914697731710374013

Contact

For more information or to report further issues, please contact the team at [email protected].

Incident Response Timeline