BTC$94,084.24-0.30%ETH$1,772.97-1.88%USDT$1.0004+0.00%XRP$2.2775+1.25%BNB$602.29-0.21%SOL$146.71-2.14%USDC$1.0000-0.00%DOGE$0.1762-2.76%ADA$0.6982-1.03%TRX$0.2470-0.53%SUI$3.5576-2.08%LINK$14.76+0.47%AVAX$21.80-0.77%XLM$0.2843-0.82%LEO$8.9911-0.19%TON$3.2330-0.28%HBAR$0.1920+1.16%SHIB$0.0₄1357-0.43%BCH$348.19-0.81%LTC$85.07-1.98%
News
Back to menu
News
- Markets
- Finance
- Tech
- Policy
- Focus
Prices
Back to menu
Prices
Data
Back to menu
Data
- Trade Data
- Derivatives
- Order Book Data
- On-Chain Data
- API
- Data Catalogue
Indices
Back to menu
Indices
- Multi-Asset Indices
- Reference Rates
- Strategies and Services
- API
Research
Back to menu
Research
Consensus
Back to menu
Consensus
- Consensus 2025
- Consensus 2025 Coverage
Sponsored
Back to menu
Sponsored
- Thought Leadership
- Press Releases
- CoinW
- MEXC
- Phemex
- Advertise
Videos
Back to menu
Videos
- CoinDesk Daily
- Shorts
- Editor's Picks
Podcasts
Back to menu
Podcasts
- CoinDesk Podcast Network
- Markets Daily
- Gen C
- Unchained with Laura Shin
- The Mining Pod
Newsletters
Back to menu
Newsletters
- The Node
- Crypto Daybook Americas
- State of Crypto
- Crypto for Advisors
Back to menu
Webinars & Events
- Consensus 2025
Select Language
- News
- Prices
- Data
- Indices
- Research
- Consensus
- Sponsored
- Sign In
- Sign Up
Markets
Share this article
The issue only affects versions of Node Package Manager (NPM), a site where developers share reusable code for projects.
By
Shaurya Malwa|Edited by Parikshit Mishra
Apr 23, 2025, 8:00 a.m.
What to know:
- A threat actor exploited an XRP Ledger developer access token to publish illicit code, potentially causing a catastrophic impact on the network.
- The vulnerability affected specific versions of the Node Package Manager, but major XRP services like Xaman Wallet and XRPScan were unaffected.
- The XRP Ledger Foundation quickly released updated versions of the tool to fix the issue, urging projects to upgrade to the latest version immediately.
A threat actor seemingly exploited an XRP Ledger’s developer access token to publish illicit code to the burgeoning network in a move that could have been “catastrophic” for the network, the security team that spotted the issue said in an update.
Charlie Eriksen, a researcher at Aikido Security who first spotted the problem, said a hidden issue was added to recent versions of a new toolkit used to build apps that work with the XRP Ledger.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
By signing up, you will receive emails about CoinDesk products and you agree to our terms of use and privacy policy.
“A developer's NPM access token was stolen by the threat actors,” Aikido said on X. “It is unclear how right now. It is also unclear who the threat actors are right now (although we have a hunch we are trying to confirm).”
The issue only affects versions of Node Package Manager (NPM), a site where developers share reusable code for projects. Major XRP-related services, like Xaman Wallet and XRPScan, said they were unaffected in separate X posts.
— Robert @XamanWallet (@robertkiuru) April 22, 2025With today’s npm vulnerability, it’s a clear reminder about truly knowing what you’re using.
At Xaman, our track record speaks for itself.
We’ve been feature-complete, security-first from day one, building everything in-house.
No shortcuts.
This is what trust looks like. https://t.co/LH1nEFrlPH
This flaw could let attackers steal users’ private keys, possibly accessing their crypto wallets in theory.
"At 21 Apr, 20:53 GMT+0, our system, Aikido Intel started to alert us to five new package version of the xrpl package. It is the official SDK for the XRP Ledger, with more than 140.000 weekly downloads," Eriksen said in a security update.
"This package is used by hundreds of thousands of applications and websites making it a potentially catastrophic supply chain attack on the cryptocurrency ecosystem," Eriksen noted.
He added that only third-party apps or services that installed the flawed versions during a brief period could be at risk.
As such, the XRP Ledger Foundation team quickly fixed the issue by releasing updated versions of the tool to replace the faulty ones. The affected versions (v4.2.1-4.2.4 and v2.14.2) were deprecated.
"To clarify: This vulnerability is in xrpl.js, a JavaScript library for interacting with the XRP Ledger. It does NOT affect the XRP Ledger codebase or Github repository itself. Projects using xrpl.js should upgrade to v4.2.5 immediately," the foundation posted separately.
To clarify: This vulnerability is in xrpl.js, a JavaScript library for interacting with the XRP Ledger. It does NOT affect the XRP Ledger codebase or Github repository itself. Projects using xrpl.js should upgrade to v4.2.5 immediately.
— XRP Ledger Foundation (Official) (@XRPLF) April 22, 2025
A JavaScript library is a collection of pre-written code to simplify tasks in web development. A GitHub repo is an online storage space for a project's code, files, and history, hosted on GitHub.
XRP prices are up 8.5% in the past 24 hours alongside a broader market jump.
Shaurya Malwa
Shaurya is the Co-Leader of the CoinDesk tokens and data team in Asia with a focus on crypto derivatives, DeFi, market microstructure, and protocol analysis.
Shaurya holds over $1,000 in BTC, ETH, SOL, AVAX, SUSHI, CRV, NEAR, YFI, YFII, SHIB, DOGE, USDT, USDC, BNB, MANA, MLN, LINK, XMR, ALGO, VET, CAKE, AAVE, COMP, ROOK, TRX, SNX, RUNE, FTM, ZIL, KSM, ENJ, CKB, JOE, GHST, PERP, BTRFLY, OHM, BANANA, ROME, BURGER, SPIRIT, and ORCA.
He provides over $1,000 to liquidity pools on Compound, Curve, SushiSwap, PancakeSwap, BurgerSwap, Orca, AnySwap, SpiritSwap, Rook Protocol, Yearn Finance, Synthetix, Harvest, Redacted Cartel, OlympusDAO, Rome, Trader Joe, and SUN.
