A sophisticated malware campaign has struck the dYdX cryptocurrency exchange, leaving users' wallets vulnerable to theft. The malicious packages, published on both npm and PyPI repositories, contain code that steals wallet credentials from developers and backend systems, as well as backdoors that allow attackers to remotely access infected devices.
Researchers at security firm Socket have discovered that the malware was embedded in open-source packages published on these platforms. When a seed phrase used for wallet security is processed, the malicious function exfiltrates it, along with a fingerprint of the device running the app. This information allows the threat actor to track victims across multiple compromises.
The affected packages include versions 3.4.1 and 1.22.1 of the @dydxprotocol/v4-client-js library on npm, as well as version 1.1.5post1 of the dydx-v4-client package on PyPI. The malware also implements a remote access Trojan (RAT) that allows the execution of new malware on infected systems.
The incident is at least the third time dYdX has been targeted in attacks, with previous events including a September 2022 uploading of malicious code to the npm repository and a 2024 DNS hijacking incident. Users of the platform are advised to carefully examine all apps for dependencies on the listed malicious packages.
As Socket noted, this latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. The use of compromised official accounts to publish malicious packages underscores the importance of vigilance and careful app review in preventing such attacks.
Researchers at security firm Socket have discovered that the malware was embedded in open-source packages published on these platforms. When a seed phrase used for wallet security is processed, the malicious function exfiltrates it, along with a fingerprint of the device running the app. This information allows the threat actor to track victims across multiple compromises.
The affected packages include versions 3.4.1 and 1.22.1 of the @dydxprotocol/v4-client-js library on npm, as well as version 1.1.5post1 of the dydx-v4-client package on PyPI. The malware also implements a remote access Trojan (RAT) that allows the execution of new malware on infected systems.
The incident is at least the third time dYdX has been targeted in attacks, with previous events including a September 2022 uploading of malicious code to the npm repository and a 2024 DNS hijacking incident. Users of the platform are advised to carefully examine all apps for dependencies on the listed malicious packages.
As Socket noted, this latest attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. The use of compromised official accounts to publish malicious packages underscores the importance of vigilance and careful app review in preventing such attacks.
! It's so frustrating when you're just trying to invest in some crypto and then you find out your wallet's been compromised 
. And it's not like dYdX is the only one - I mean, have you seen all the recent articles about hackers attacking other exchanges? 
It's like they're just sitting ducks.
I mean, you'd think that developers would want to protect their own users' data, right?
. And if you're using dYdX, yeah, make sure to update that client-js library ASAP 
.
. I'm not surprised though, these platforms are basically just a target for scammers. And now they're using open-source packages to spread the malware? That's just basic, lazy attack methods 
. Like, can't they do better than that? 
.
We need better security measures in place to prevent this kind of thing from happening again 
.
can't believe they let this happen for the 3rd time already...anyway, anyone else know what packages to watch out for? gotta be super careful when installing new apps or something...and yeah, npm and PyPI are basically just a mess at this point 
. And what's up with this pattern of attacks? It's like they're trying to exploit the fact that devs trust open-source packages too much 
. We need to start being more careful about where we get our software from, especially when it comes to high-stakes stuff like crypto exchanges 
. I'm not saying dYdX is doing anything wrong, but it's clear they need to step up their game if they want to stay secure 
.
it's so messed up that the malware was hiding in plain sight on npm and PyPI, like, how hard is it to check for malicious code? 
gotta make sure to review all my apps and update them ASAP 
or we're gonna see more people losing their seed phrases and getting exploited. and can we talk about how easy it is for these bad guys to track victims across multiple compromises? that's just basic security 101, dYdX! 
especially when its from a package they were supposed to be trustworthy with. and yeah, the fact that its been happenin' like 3 times already is super concerning... dYdX should really do somethin about this ASAP! 
They're like, always finding ways to exploit people's trust by publishing malware in legit repos 
. And honestly, can't we just get some better security measures in place already? 
Like, a secure package manager that's not so easy for hackers to manipulate 
. It's all too convenient for them...