GHSA-33qr-m49q-rxfx

Suggest an improvement
Source
https://github.com/advisories/GHSA-33qr-m49q-rxfx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-33qr-m49q-rxfx/GHSA-33qr-m49q-rxfx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-33qr-m49q-rxfx
Aliases
Published
2025-04-22T18:57:48Z
Modified
2025-04-22T23:53:56Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
Details

Impact

Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. If you are using one of these versions, stop immediately and rotate any private keys or secrets used with affected systems.

Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions.

Patches

Upgrade to version 4.2.5 or 2.14.3.

Required Actions

To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys:

The XRP Ledger supports key rotation: https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/assign-a-regular-key-pair

If any account's master key is potentially compromised, you should disable it: https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/disable-master-key-pair

References

https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor

Database specific 
{
    "cwe_ids":  [
        "CWE-506"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-22T18:57:48Z",
    "nvd_published_at":  "2025-04-22T21:15:45Z",
    "severity":  "CRITICAL"
}
References

Affected packages

npm / xrpl

Package

Name
xrpl
View open source insights on deps.dev
Purl
pkg:npm/xrpl

Affected ranges

Type
SEMVER
Events
Introduced
4.2.1
Fixed
4.2.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-33qr-m49q-rxfx/GHSA-33qr-m49q-rxfx.json"

npm / xrpl

Package

Name
xrpl
View open source insights on deps.dev
Purl
pkg:npm/xrpl

Affected ranges

Type
SEMVER
Events
Introduced
2.14.2
Fixed
2.14.3

Affected versions

2.*
2.14.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-33qr-m49q-rxfx/GHSA-33qr-m49q-rxfx.json"