CVE-2025-32965
1 advisory.
npm/xrpl CVE-2025-32965: critical
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
Action: Upgrade xrpl to 2.14.3 or later.
npm i xrpl@4.2.5npm i xrpl@2.14.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.2.1 | 4.2.5 | - |
| 2.14.2 | 2.14.3 | - |
Fixed versions
| 4.2.5 | 2.14.3 |
Sources
- osv: GHSA-33qr-m49q-rxfx
- https://github.com/XRPLF/xrpl.js/security/advisories/GHSA-33qr-m49q-rxfx
- https://nvd.nist.gov/vuln/detail/CVE-2025-32965
- https://github.com/XRPLF/xrpl.js
- https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor
- https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/assign-a-regular-key-pair
- https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/disable-master-key-pair
CVE-2025-32965 · published · modified · JSON