The XRP Ledger Foundation has uncovered a malicious JavaScript package containing a backdoor capable of stealing cryptocurrency assets, prompting immediate action from the developer community.
The compromised package, named “ledgerhq,” was discovered on the NPM (Node Package Manager) repository. According to developers at the foundation, the package appeared to mimic legitimate code associated with Ledger hardware wallets but included malicious modifications designed to exfiltrate private keys and drain crypto wallets.
Upon identification, the XRP Ledger Foundation quickly issued warnings to the broader developer ecosystem, urging immediate removal of the package from any projects and recommending thorough audits of dependencies. The foundation credited its internal monitoring and open-source vigilance for the discovery.
The attacker had reportedly uploaded the package under a name similar to the legitimate Ledger library to deceive developers into using it unknowingly. Once integrated into applications, the backdoor would stealthily collect sensitive wallet information and transmit it to an external server.
The malicious package was swiftly removed from the NPM registry following reports. Security experts are continuing to investigate the full extent of its distribution and potential impact.
This incident highlights the growing sophistication of supply chain attacks targeting the crypto industry, particularly through open-source repositories. The XRP Ledger Foundation has called on developers to implement stricter code validation procedures and to verify package authenticity before integrating third-party libraries.
The foundation also emphasized its commitment to maintaining a secure development environment and announced plans to collaborate with other blockchain ecosystems to improve threat detection and response mechanisms across the crypto space.