Vulnerability in Xrplf Xrpl.js
CVE-2025-32965
xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key.
Published · last modified .
EPSS exploit prediction
EPSS: 0.009 (58.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: +0.000
Affected products
- Xrplf Xrpl.js — versions >= 4.2.1, < 4.2.5, = 2.14.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/XRPLF/xrpl.js/security/advisories/GHSA-33qr-m49q-rxfx
- www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-c…
- xrpl.org/docs/tutorials/how-tos/manage-account-settings/assign-a-regular-key-pa…
- xrpl.org/docs/tutorials/how-tos/manage-account-settings/disable-master-key-pair
Frequently asked questions
- What is CVE-2025-32965?
- CVE-2025-32965 is a vulnerability in Xrplf Xrpl.js, classified under CWE-506. Published 2025-04-22.
- Is CVE-2025-32965 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.