- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 918
Now there's a surprise hidden inside the code that even the pros don't know about.
Socket analysts have discovered a targeted attack on the supply chain of libraries for working with the dYdX crypto exchange. Malicious versions of client packages appeared simultaneously in the npm and PyPI repositories after compromising the account of one of the maintainers. The modified assemblies were used to steal cryptographic wallet data and secretly run remote code.
The team of specialists reported that the substituted packages related to dYdX v4 client for JavaScript and Python. These tools are used in trading bots, algorithmic strategies, and portfolio management services. Seed phrases, keys, and transaction signing operations are processed through them, so such dependencies are of increased value to intruders.
Infected versions of @dydxprotocol/v4-client-js were published in npm with numbers 1.0.31, 1.15.2, 1.22.1 and 3.4.1. The version of dydx-v4-client 1.1.5post1 is affected in the PyPI catalog. The malicious code was embedded inside the main library files and looked like standard logic. The publication was made with legitimate rights, which indicates the hijacking of the maintainer's account, and not the vulnerability of the repositories themselves.
The JavaScript version sent seed phrases and the device's digital fingerprint to a third-party domain disguised as the dYdX infrastructure. The fingerprint collection included information about the operating system, hostname, and machine IDs. Transmission errors were suppressed, so suspicious activity was not reflected in the logs.
The Python package contained not only a data theft module, but also a hidden remote control component. It was deployed automatically when importing the library, went through a multi-stage unpacking and contacted the management server. After that, arbitrary code was loaded, which was executed in the background without output or traces for the user. This mechanism allowed access to keys, service tokens, source files, and other systems on the network.
The infrastructure for receiving data was registered in January 2026 and imitated the price oracle service. After being notified by Socket, the dYdX team confirmed the problem and alerted the developers. Malicious releases were identified shortly after publication.
This is not the first incident surrounding the dYdX ecosystem. Previously, there were cases of substitution of npm dependencies and interception of the DNS domain of the web version of the service. The current attack differs in that it affected two ecosystems at once and added a mechanism for hidden remote access. Experts note the growing interest of attackers in popular cryptographic messages and recommend checking dependency versions and publication sources.
Socket analysts have discovered a targeted attack on the supply chain of libraries for working with the dYdX crypto exchange. Malicious versions of client packages appeared simultaneously in the npm and PyPI repositories after compromising the account of one of the maintainers. The modified assemblies were used to steal cryptographic wallet data and secretly run remote code.
The team of specialists reported that the substituted packages related to dYdX v4 client for JavaScript and Python. These tools are used in trading bots, algorithmic strategies, and portfolio management services. Seed phrases, keys, and transaction signing operations are processed through them, so such dependencies are of increased value to intruders.
Infected versions of @dydxprotocol/v4-client-js were published in npm with numbers 1.0.31, 1.15.2, 1.22.1 and 3.4.1. The version of dydx-v4-client 1.1.5post1 is affected in the PyPI catalog. The malicious code was embedded inside the main library files and looked like standard logic. The publication was made with legitimate rights, which indicates the hijacking of the maintainer's account, and not the vulnerability of the repositories themselves.
The JavaScript version sent seed phrases and the device's digital fingerprint to a third-party domain disguised as the dYdX infrastructure. The fingerprint collection included information about the operating system, hostname, and machine IDs. Transmission errors were suppressed, so suspicious activity was not reflected in the logs.
The Python package contained not only a data theft module, but also a hidden remote control component. It was deployed automatically when importing the library, went through a multi-stage unpacking and contacted the management server. After that, arbitrary code was loaded, which was executed in the background without output or traces for the user. This mechanism allowed access to keys, service tokens, source files, and other systems on the network.
The infrastructure for receiving data was registered in January 2026 and imitated the price oracle service. After being notified by Socket, the dYdX team confirmed the problem and alerted the developers. Malicious releases were identified shortly after publication.
This is not the first incident surrounding the dYdX ecosystem. Previously, there were cases of substitution of npm dependencies and interception of the DNS domain of the web version of the service. The current attack differs in that it affected two ecosystems at once and added a mechanism for hidden remote access. Experts note the growing interest of attackers in popular cryptographic messages and recommend checking dependency versions and publication sources.
