{"action":"Upgrade xrpl to 2.14.3 or later.","affected":[{"fixed":"4.2.5","introduced":"4.2.1"},{"fixed":"2.14.3","introduced":"2.14.2"}],"component":"xrpl","cve_ids":["CVE-2025-32965"],"ecosystem":"npm","epss":0.00922,"exploited":false,"fixed_versions":["4.2.5","2.14.3"],"ghsa_id":"GHSA-33qr-m49q-rxfx","id":"tcs_01M5KEVSD2H96WXHATZDMH2998","modified_at":"2025-04-22T23:53:56Z","published_at":"2025-04-22T18:57:48Z","references":["https://osv.dev/vulnerability/GHSA-33qr-m49q-rxfx","https://github.com/XRPLF/xrpl.js/security/advisories/GHSA-33qr-m49q-rxfx","https://nvd.nist.gov/vuln/detail/CVE-2025-32965","https://github.com/XRPLF/xrpl.js","https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor","https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/assign-a-regular-key-pair","https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/disable-master-key-pair"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-33qr-m49q-rxfx","url":"https://osv.dev/vulnerability/GHSA-33qr-m49q-rxfx"},{"source":"nvd","source_id":"CVE-2025-32965","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32965"}],"summary":"Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2"}