Quick Summary
Cybersecurity researchers have identified a supply chain attack involving compromised versions of the @dydxprotocol/v4-client-js and dydx-v4-client packages on npm and PyPI. These malicious packages are designed to steal cryptocurrency wallet credentials and execute remote access trojans (RATs). The incident highlights ongoing risks in software supply chains, particularly for users of decentralized finance platforms like dYdX, which has seen over $1.5 trillion in trading volume.
The Securityish Brief
Researchers discovered that the @dydxprotocol/v4-client-js package on npm and the dydx-v4-client package on PyPI were compromised to distribute malware. The attack was likely facilitated by a developer account compromise, allowing the threat actors to publish malicious updates using legitimate credentials. The npm version focuses on stealing cryptocurrency wallet seed phrases and device information, while the PyPI version includes a RAT that connects to an external server for command execution.
Upon responsible disclosure on January 28, 2026, dYdX acknowledged the incident and advised users to isolate affected machines and move funds to new wallets. The compromised packages are particularly concerning as they handle sensitive cryptocurrency operations, and dYdX has previously faced similar supply chain attacks, including a 2022 npm account hijacking.
This recent attack underscores a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. The coordinated deployment of malicious code across both JavaScript and Python ecosystems indicates a high level of planning and knowledge of package internals by the threat actor.
Supply Chain Risks and User Awareness
The incident reflects the growing sophistication of software supply chain threats, which exploit the trust associated with open-source repositories. Attackers can compromise multiple users simultaneously, making it essential for developers and organizations to remain vigilant about the security of their dependencies.
Additionally, Aikido’s analysis revealed that 128 phantom npm packages, which were never published, collectively received over 121,000 downloads, highlighting a blind spot in npm’s protections against typosquatting. This situation emphasizes the importance of verifying package existence before installation.
Developers should adopt best practices to mitigate risks, such as using the “npx –no-install” command to prevent registry fallback and explicitly installing CLI tools. By taking these precautions, users can better protect themselves from potential malware distribution through compromised packages.
Key Takeaways
- Isolate any affected machines immediately if you suspect downloading compromised packages.
- Move cryptocurrency funds to a new wallet from a clean system to prevent theft.
- Rotate all API keys and credentials associated with the dYdX platform.
- Verify the existence of packages before installation to avoid typosquatting risks.
- Use “npx –no-install” to block registry fallback and prevent arbitrary code execution.
Key Terms & Concepts
- Remote Access Trojan (RAT): In this article, a RAT refers to malware that allows unauthorized access to a user’s device after a compromised package is imported.
- Supply Chain Attack: This term describes a cyber attack that targets software supply chains to distribute malicious code through trusted sources.
- Typosquatting: Typosquatting is a tactic where attackers register misspelled versions of popular package names to distribute malware.
Read the original article here: https://thehackernews.com/2026/02/compromised-dydx-npm-and-pypi-packages.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
