Malicious code embedded in open-source packages has led to cryptocurrency theft and potential backdooring of devices, impacting users of the dYdX cryptocurrency exchange. Researchers from security firm Socket reported that compromised packages on npm and PyPI repositories stole wallet credentials, resulting in complete wallet compromise and irreversible cryptocurrency theft, according to Ars Technica. The attack targeted dYdX developers and backend systems.
The compromised packages included npm (dydxprotocolv4-client-js): 3.4.1 and 1.22.1, putting all applications using these versions at risk, Ars Technica reported. The scope of the attack encompasses all applications dependent on the compromised versions, affecting both developers testing with real credentials and end-users.
This incident highlights a growing threat: the identity and access management (IAM) pivot, as described by VentureBeat. This attack chain can begin with a seemingly legitimate LinkedIn message, leading to the installation of a malicious package that exfiltrates cloud credentials, including GitHub personal access tokens and AWS API keys. According to VentureBeat, the adversary can gain access to the cloud environment within minutes.
Meanwhile, in the cryptocurrency market, Bitcoin experienced a downturn. According to Fortune, Bitcoin's value has fallen significantly, dropping from a high of approximately $125,000 per coin in October 2025 to a low of $61,300. Shares in Michael Saylor's Bitcoin treasury company, Strategy, also declined, falling 17% and are down 75% from their peak last year.
In other news, the State Department is removing all posts on its public accounts on X made before President Trump returned to office on January 20, 2025, according to NPR. The posts will be internally archived, and anyone wanting to see older posts will have to file a Freedom of Information Act request, a State Department employee confirmed to NPR.
The StrongDM Software Factory, as described on Hacker News, is focused on non-interactive development where specs and scenarios drive agents to write code. The goal is to accelerate teams toward a "factory" of their own.
Discussion
AI Experts & Community
Be the first to comment