CVE-2025-32965: 
JavaScript vulnerability analysis and mitigation

A critical supply chain attack was discovered in xrpl.js, a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. The vulnerability (CVE-2025-32965) affects versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2, which were compromised and contained malicious code designed to exfiltrate private keys. The package, with over 140,000 weekly downloads, was compromised on April 21, 2025, when an attacker gained access to a developer's npm credentials (Aikido Blog, Security Online).

The attacker introduced a malicious function named checkValidityOfSeed that secretly transmits wallet credentials to an external domain (0x9c[.]xyz). The compromise was executed through multiple version releases in a short timespan, with the attacker trying different methods to evade detection. The vulnerability has received a CVSS v4.0 score of 9.3 (Critical), indicating its severe nature. The GitHub repository itself remained unaffected by the backdoor (GitHub Advisory, Aikido Blog).

The vulnerability potentially affects hundreds of applications and websites using the xrpl.js package, putting cryptocurrency wallets at risk of compromise. Any private keys or secrets processed by the affected versions may have been exposed to the attackers, potentially leading to unauthorized access to cryptocurrency funds (Security Online, Aikido Blog).

Users are advised to immediately upgrade to patched versions 4.2.5 (for 4.x branch) or 2.14.3 (for 2.x branch). Any private keys or secrets used with affected systems should be rotated immediately. For compromised accounts, users should utilize the XRP Ledger's key rotation mechanisms or disable master keys if potentially compromised (GitHub Advisory, XRPL Docs).

The XRP Ledger Foundation issued a statement clarifying that while the vulnerability affects the JavaScript library, it does not impact the XRP Ledger codebase or GitHub repository itself. The security community has emphasized the severity of this supply chain attack, particularly given the package's widespread use in the cryptocurrency ecosystem (Wiz).