Apr 23, 05:17 PM

XRP Ledger Foundation Removes Backdoor-Compromised JavaScript Library After April 21 Supply Chain Attack Targeting Private Keys

The XRP Ledger Foundation identified a serious vulnerability in the official JavaScript library (xrpl.js) used to interact with the XRP Ledger blockchain. On April 21, a malicious actor compromised the software development kit (SDK) stack by inserting a backdoor into the JavaScript library, a supply chain attack that targeted XRP holders. Security experts at Aikido Security and other cybersecurity analysts confirmed the breach, which aimed to hunt for private keys through the compromised Ripple NPM package. In response, the XRP Ledger Foundation upgraded the code repository to remove the compromised version. The incident has reignited criticism from Bitcoin developer Peter Todd, who had previously warned about Ripple’s lack of secure software signing practices, highlighting ongoing concerns about Ripple’s software security.