Malicious npm/PyPI packages used to drain dYdX wallets via compromised dYdX libraries

Security researchers at Socket reported that attackers published malicious versions of official dYdX client libraries to npm and PyPI, stealing wallet seed phrases and device fingerprints to drain user wallets. Affected packages include npm @dydxprotocol/v4-client-js (versions 3.4.1, 1.22.1, 1.15.2, 1.0.31) and PyPI dydx-v4-client (1.1.5post1). The npm payload exfiltrated seed phrases and a device fingerprint to a typosquatted domain (dydx[.]priceoracle[.]site), while the PyPI package added a RAT that beacons to the same command-and-control server, can run arbitrary Python code, steal SSH keys and API credentials, and persist on systems. Socket says the malicious packages were published using compromised official dYdX accounts and warned that all applications depending on these versions — including developer testing with real credentials and production services — are at risk. dYdX has not yet issued a public response. Researchers note this is at least the third targeting of dYdX via supply-chain or DNS attacks (notable incidents in Sept 2022 and a 2024 DNS hijack), highlighting a growing trend of attackers abusing trusted distribution channels. Traders and dev teams are advised to audit dependencies, rotate keys/mnemonics, and inspect systems for backdoors or exfiltration indicators.