A whole host of crypto npm packages have been compromised TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. A whole host of crypto npm packages have been compromised By Sead Fadilpašić published 26 September 2022 Someone's trying to steal information from crypto projects (Image credit: Shutterstock.com) Audio player loading… A number of npm packages published by a major cryptocurrency exchange have been compromised and updated to carry malicious code Decentralized cryptocurrency exchange (DEX) dydX tweeted its discovery of the compromise, and how it was acting to remedy the problem. "At 6:14AM EST, we identified malicious versions published to a number of dYdX NPM packages that were quickly removed," its tweet (opens in new tab) read. "All funds are SAFE, our websites/apps have NOT been compromised, the attack did NOT impact smart contracts." Multiple packages spreading infostealers Further explaining how user funds aren't compromised, the company said: "Reminder that dYdX does not have custody of user funds, which are deposited directly to a smart contract on the blockchain." Cybersecurity researcher Maciej Mensfeld of security firm Mend and Difend.io, found that some packages contained code that would run information stealing malware when run. He found three packages that were hijacked to be used in identity theft (opens in new tab) attacks.@dydxprotocol/solo - versions 0.41.1, 0.41.2 @dydxprotocol/perpetual - versions 1.2.2, 1.2.3 Allegedly, the package '@dydxprotocol/node-service-base-dev' was also compromised, but that one has since been pulled from the platform. The packages are described as "Ethereum Smart Contracts and TypeScript library used for the dYdX Solo Trading Protocol." The solo package, the publication found, is used by at least 44 GitHub repositories, being built by "multiple crypto platforms."Read more> A nasty new infostealer malware is landing in email inboxes > A nasty new infostealer malware is landing in email inboxes > These are the best endpoint protection services around Apparently, this is not the first time threat actors were trying to smuggle this identical malicious code into various packages. In fact, BleepingComputer claims to have seen code "strikingly identical" to this one in the malicious "PyGrata" Python packages that were stealing Amazon Web Services (AWS) credentials, environment variables, as well as SSH keys. Code repositories are often the targets of malicious actors who sometimes build malicious versions of popular repositories and give them similar names, in hopes of overworked/reckless developers unknowingly picking the wrong one.Check out our list of the best firewalls (opens in new tab) around Via: BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1One of the world's most popular programming languages is coming to Linux2Apple October launches: the new devices we might see this month3Google's AI editing tricks are making Photoshop irrelevant for most people4You may not have to sell a body part to afford the Nvidia RTX 4090 after all5The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me1We finally know what 'Wi-Fi' stands for - and it's not what you think2Best laptops for designers and coders 3Miofive 4K Dash Cam review4Logitech's latest webcam and headset want to relieve your work day frustrations5Best offers on Laptops for Education – this festive season Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)