According to Aikido Security, a cryptographic security research firm, the official XRPL NPM package has been found to contain security bugs. The backdoor steals the user's private key and sends it to the attacker. The affected versions are 4.2.1 to 4.2.4, and Aikido Security recommends that users using earlier versions do not upgrade the version for the time being.
据加密安全研究机构 Aikido Security 监测,官方 XRPL NPM 包被发现存在安全漏洞。该后门程序会窃取用户私钥并将其发送给攻击者。受影响版本为 4.2.1 至 4.2.4,Aikido Security 建议使用较早版本的用户暂勿进行版本升级。