CoinDesk 2025-04-23 08:00:17

XRP Ledger Bug Patched After 'Serious' Flaw Spotted in XRPL Library

A threat actor seemingly exploited an XRP Ledger’s developer access token to publish illicit code to the burgeoning network in a move that could have been “catastrophic” for the network, the security team that spotted the issue said in an update . Charlie Eriksen, a researcher at Aikido Security who first spotted the problem, said a hidden issue was added to recent versions of a new toolkit used to build apps that work with the XRP Ledger. “A developer's NPM access token was stolen by the threat actors,” Aikido said on X. “It is unclear how right now. It is also unclear who the threat actors are right now (although we have a hunch we are trying to confirm).” The issue only affects versions of Node Package Manager (NPM), a site where developers share reusable code for projects. Major XRP-related services, like Xaman Wallet and XRPScan, said they were unaffected in separate X posts. This flaw could let attackers steal users’ private keys, possibly accessing their crypto wallets in theory. "At 21 Apr, 20:53 GMT+0, our system, Aikido Intel started to alert us to five new package version of the xrpl package. It is the official SDK for the XRP Ledger, with more than 140.000 weekly downloads," Eriksen said in a security update. "This package is used by hundreds of thousands of applications and websites making it a potentially catastrophic supply chain attack on the cryptocurrency ecosystem," Eriksen noted. He added that only third-party apps or services that installed the flawed versions during a brief period could be at risk. As such, the XRP Ledger Foundation team quickly fixed the issue by releasing updated versions of the tool to replace the faulty ones. The affected versions (v4.2.1-4.2.4 and v2.14.2) were deprecated. "To clarify: This vulnerability is in xrpl.js, a JavaScript library for interacting with the XRP Ledger. It does NOT affect the XRP Ledger codebase or Github repository itself. Projects using xrpl.js should upgrade to v4.2.5 immediately," the foundation posted separately. A JavaScript library is a collection of pre-written code to simplify tasks in web development. A GitHub repo is an online storage space for a project's code, files, and history, hosted on GitHub. XRP prices are up 8.5% in the past 24 hours alongside a broader market jump.

Наиболее читаемые новости

XRP Faces Uncertainty Amidst Wedge Formation...
2025-05-18
How Ripple Gains Indirect Access to FED Maste...
2025-05-18
XRP’s tight wedge persists: 3 major risks tra...
2025-05-18
Canada plans to keep 25% retaliatory tariffs...
2025-05-18
Ethereum and Solana: A Deep Dive into Network...
2025-05-18
Metaplanet Hits All-Time High $6M Q1 Revenue...
2025-05-18
Bitcoin’s Setup Deepens — This Formation Coul...
2025-05-18
Bitcoin Flatlines as XRP and Cardano Traders...
2025-05-18

Связанные новости

Прочтите Отказ от ответственности : Весь контент, представленный на нашем сайте, гиперссылки, связанные приложения, форумы, блоги, учетные записи социальных сетей и другие платформы («Сайт») предназначен только для вашей общей информации, приобретенной у сторонних источников. Мы не предоставляем никаких гарантий в отношении нашего контента, включая, но не ограничиваясь, точность и обновление. Никакая часть содержания, которое мы предоставляем, представляет собой финансовый совет, юридическую консультацию или любую другую форму совета, предназначенную для вашей конкретной опоры для любых целей. Любое использование или доверие к нашему контенту осуществляется исключительно на свой страх и риск. Вы должны провести собственное исследование, просмотреть, проанализировать и проверить наш контент, прежде чем полагаться на них. Торговля - очень рискованная деятельность, которая может привести к серьезным потерям, поэтому проконсультируйтесь с вашим финансовым консультантом, прежде чем принимать какие-либо решения. Никакое содержание на нашем Сайте не предназначено для запроса или предложения