Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware

Cybersecurity researchers have uncovered a sophisticated supply chain attack targeting the dYdX cryptocurrency ecosystem, where legitimate npm and PyPI packages were compromised to deliver cryptocurrency wallet stealers and remote access trojans to unsuspecting developers.

The Attack Details

The compromised packages include:

• @dydxprotocol/v4-client-js (npm) - versions 3.4.1, 1.22.1, 1.15.2, 1.0.31
• dydx-v4-client (PyPI) - version 1.1.5post1

These packages provide developers with tools to interact with the dYdX v4 protocol, including transaction signing, order placement, and wallet management. The attack demonstrates how threat actors are increasingly targeting cryptocurrency infrastructure through trusted distribution channels.

How the Malware Works

The malicious code was inserted into core registry files (registry.ts, registry.js, account.py) that execute during normal package usage. The npm version acts as a cryptocurrency wallet stealer that siphons seed phrases and device information, while the PyPI version incorporates both wallet stealer functionality and a remote access trojan (RAT).

The RAT component, which runs as soon as the package is imported, contacts an external server ("dydx.priceoracle[.]site/py") to retrieve commands for subsequent execution on the host. On Windows systems, it uses the "CREATE_NO_WINDOW" flag to execute without a console window, making detection more difficult.

Attribution and Methodology

While the exact method of compromise remains unclear, researchers suspect this is a case of developer account compromise, as the rogue versions were published using legitimate publishing credentials. The threat actor demonstrated detailed knowledge of package internals and maintained consistent exfiltration endpoints, API keys, and device fingerprinting logic across both ecosystems.

"The 100-iteration obfuscation in the PyPI version and the coordinated cross-ecosystem deployment suggest the threat actor had direct access to publishing infrastructure rather than exploiting a technical vulnerability in the registries themselves," noted Socket security researcher Kush Pandya.

Historical Context

This attack is part of a persistent pattern targeting dYdX-related assets. In September 2022, the npm account of a dYdX staff member was hijacked to publish versions containing code to steal credentials. In 2024, the dYdX v3 platform website was compromised to redirect users to a phishing site designed to drain wallets.

Mitigation and Response

Following responsible disclosure on January 28, 2026, dYdX acknowledged the incident and urged affected users to:

• Isolate affected machines
• Move funds to new wallets from clean systems
• Rotate all API keys and credentials

The company emphasized that "the versions of dydx-v4-clients hosted in the dydxprotocol Github do not contain the malware."

Broader Supply Chain Implications

The dYdX attack comes alongside revelations about another supply chain vulnerability involving "phantom packages" on npm. Aikido researchers discovered 128 packages referenced in documentation but never published, which could be claimed by threat actors to distribute malware.

These phantom packages collectively racked up 121,539 downloads between July 2025 and January 2026, with some seeing thousands of weekly downloads. The most popular included:

• openapi-generator-cli (48,356 downloads)
• cucumber-js (32,110 downloads)
• depcruise (15,637 downloads)

Prevention Strategies

To mitigate these risks, security experts recommend:

For phantom package threats:

• Use "npx --no-install" to block registry fallback
• Install CLI tools explicitly
• Verify package existence before running commands
• Register obvious aliases and misspellings

For general supply chain security:

• Monitor for unusual package behavior
• Use dependency scanning tools
• Implement strict version pinning
• Verify package integrity through checksums

"Sophisticated attackers are moving upstream into the software supply chain because it provides a deep, low-noise initial access path into downstream environments," said Sygnia's Omer Kidron. "The same approach supports both precision compromise and opportunistic attacks at scale."

The dYdX incident underscores the critical importance of supply chain security in the cryptocurrency and broader software development ecosystems, where a single compromised package can affect thousands of users and result in significant financial losses.