Compromised dYdX npm and PyPI Packages Deliver Malware

Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware

Cybersecurity researchers have discovered a new supply chain attack in which legitimate packages on npm and the Python Package Index (PyPI) repository have been compromised to push malicious versions, facilitating wallet credential theft and remote code execution. The compromised packages, @dydxprotocol/v4-client-js and dydx-v4-client, were used to steal sensitive cryptocurrency operations, with the malicious code acting as a cryptocurrency wallet stealer and incorporating a remote access trojan (RAT).

Why This Matters

The technical reality of software supply chain attacks is that they can have devastating consequences, with the potential to compromise millions of users and cause significant financial losses. In ideal models, software packages are thoroughly vetted and secure, but in reality, vulnerabilities and weaknesses can be exploited by threat actors, resulting in costly and damaging attacks. The failure scale of such attacks can be massive, with the potential to affect entire ecosystems and cause long-lasting damage.

Key Insights

• The compromised packages, @dydxprotocol/v4-client-js and dydx-v4-client, were used to steal sensitive cryptocurrency operations, with the malicious code acting as a cryptocurrency wallet stealer and incorporating a remote access trojan (RAT) (Socket security researcher Kush Pandya, 2026).
• The threat actor demonstrated detailed knowledge of the package internals, inserting malicious code into core registry files that would execute during normal package usage (Pandya, 2026).
• The npm ecosystem has millions of packages, and developers run npx commands thousands of times daily, making it a high-risk target for supply chain attacks (Aikido’s Charlie Eriksen, 2026).

Working Example

// Example of a malicious package code
const maliciousCode = require('malicious-package');
maliciousCode.execute();

# Example of a malicious package code
import malicious_package
malicious_package.execute()

Practical Applications

• Use Case: dYdX, a non-custodial, decentralized cryptocurrency exchange, was targeted by a supply chain attack, highlighting the need for robust security measures to protect against such threats.
• Pitfall: The use of unverified packages and the lack of proper security measures can lead to devastating consequences, including financial losses and compromised user data.

References:

• http://thehackernews.com/2026/02/compromised-dydx-npm-and-pypi-packages.html
• https://www.socket.dev/
• https://aikido.io/