A number of npm packages published by a major cryptocurrency exchange have been compromised and updated to carry malicious code
Decentralized cryptocurrency exchange (DEX) dydX tweeted its discovery of the compromise, and how it was acting to remedy the problem.
“At 6:14AM EST, we identified malicious versions published to a number of dYdX NPM packages that were quickly removed,” its tweet read. “All funds are SAFE, our websites/apps have NOT been compromised, the attack did NOT impact smart contracts.”
Multiple packages spreading infostealers
Further explaining how user funds aren’t compromised, the company said: “Reminder that dYdX does not have custody of user funds, which are deposited directly to a smart contract on the blockchain.”
Cybersecurity researcher Maciej Mensfeld of security firm Mend and Difend.io, found that some packages contained code that would run information stealing malware when run. He found three packages that were hijacked to be used in identity theft attacks.
- @dydxprotocol/solo - versions 0.41.1, 0.41.2
@dydxprotocol/perpetual - versions 1.2.2, 1.2.3
Allegedly, the package '@dydxprotocol/node-service-base-dev' was also compromised, but that one has since been pulled from the platform.
The packages are described as "Ethereum Smart Contracts and TypeScript library used for the dYdX Solo Trading Protocol." The solo package, the publication found, is used by at least 44 GitHub repositories, being built by “multiple crypto platforms.”
Apparently, this is not the first time threat actors were trying to smuggle this identical malicious code into various packages. In fact, BleepingComputer claims to have seen code “strikingly identical” to this one in the malicious “PyGrata” Python packages that were stealing Amazon Web Services (AWS) credentials, environment variables, as well as SSH keys.
Code repositories are often the targets of malicious actors who sometimes build malicious versions of popular repositories and give them similar names, in hopes of overworked/reckless developers unknowingly picking the wrong one.
- Check out our list of the best firewalls around
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.