CriticalPublic exploit

Malicious backdoor in xrpl.js npm package

IdentifiersCVE-2025-32965CWE-506· Embedded Malicious Code

CVE-2025-32965 describes a supply-chain compromise affecting the xrpl.js JavaScript/TypeScript SDK published to npm as xrpl. Versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2 were published with malicious code embedded in the package. The malicious functionality was designed to exfiltrate private keys and other secrets from applications or developer environments using the compromised library to interact with the XRP Ledger. The issue is not a conventional memory-safety or input-validation flaw in a legitimate function; rather, the distributed package itself was backdoored, causing consumers who installed the affected versions to execute attacker-controlled code as part of normal package use.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in disclosure of XRP Ledger private keys and related secrets, enabling compromise of wallets and unauthorized transactions. If exposed keys were used for production accounts, attackers could take control of those accounts and steal funds. Because this is a supply-chain compromise in a widely used SDK, impact may extend beyond a single host to any wallets, services, CI/CD systems, or developer workstations where the malicious package was installed and used.

Mitigation

If you can’t patch tonight, do this now.

Immediately cease use of versions 4.2.1 through 4.2.4 and 2.14.2. Identify all systems, applications, CI pipelines, and developer workstations where these versions were installed. Assume any private keys or secrets handled by those environments may have been exposed. Rotate keys, migrate funds to wallets controlled by known-good keys, and follow XRP Ledger key-rotation procedures. Where there is risk that an account master key was exposed, disable the master key. Additional mitigation includes pinning trusted package versions, verifying package integrity, and restricting secret exposure in build and runtime environments.

Remediation

Patch, then assume compromise.

Upgrade immediately to xrpl.js/xrpl version 4.2.5 or 2.14.3, depending on the supported branch. Remove affected package versions from all environments, rebuild dependencies from a trusted state, and review software supply-chain controls to ensure the malicious versions are no longer present. Any private keys or secrets that may have been exposed while affected versions were installed should be treated as compromised and rotated. For XRP Ledger accounts, move funds to secure wallets as appropriate and disable any potentially compromised master keys.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2025-32965-xrpl-js-pocMaturityPoCVerified exploit

This repository is a Proof-of-Concept (PoC) for CVE-2025-32965, demonstrating a supply chain attack on the xrpl.js library (versions 4.2.1–4.2.4 and 2.14.2). The exploit consists of a malicious module (fake_xrpl.js) that exfiltrates the generated wallet seed to an attacker-controlled HTTP endpoint (http://poc-listener:3000/xcm). The repository includes Docker configuration to set up an isolated test environment with two containers: one acting as the victim (generating and leaking the seed) and one as the attacker (receiving the seed). The main exploit logic is in fake_xrpl.js, which is invoked by test.js. The server.js file implements the attacker's listener. The repository structure is clear, with code files for the PoC, a Dockerfile for environment setup, and a detailed README explaining the vulnerability, setup, and demonstration steps. No real-world endpoints are hardcoded; the PoC uses a local Docker network for demonstration.

yusufdalbudakDisclosed Apr 23, 2025javascriptdockerfilenetwork

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

security online infoNews

Jan 27, 2026

"G_Wagon" Malware Hides in Fake NPM UI Library to Steal Cloud Keys

Unknown (only referenced as a related post title indicating a backdoor in the xrpl.js SDK).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6