Malicious code embedded in open-source packages has led to the theft of cryptocurrency wallet credentials from users of the dYdX cryptocurrency exchange, according to researchers. The compromised packages, published on the npm and PyPI repositories, backdoored devices and put all applications using the affected versions at risk, resulting in complete wallet compromise and irreversible cryptocurrency theft.
The security firm Socket reported that the attack targeted dYdX developers and backend systems. The compromised packages included npm (dydxprotocolv4-client-js) versions 3.4.1 and 1.22.1. The attack's scope extended to all applications dependent on these versions, affecting both developers testing with real credentials and end-users.
In other news, Block Inc., the payments firm led by Jack Dorsey, began notifying hundreds of employees that their jobs might be eliminated during annual performance reviews as part of a broader business overhaul. According to sources familiar with the matter, up to 10% of Block's workforce was at risk of being cut. The company had fewer than 11,000 employees as of late-November. Block has been retooling its business model and staffing since 2024, reorganizing reporting lines and outlining a plan to operate more efficiently.
Meanwhile, the State Department announced it would delete all posts on its public accounts on the social media platform X made before President Trump returned to office on January 20, 2025. The posts would be internally archived but no longer publicly visible, the State Department confirmed to NPR. Staff members were told that anyone wanting to see older posts would have to file a Freedom of Information Act request, according to a State Department employee.
Finally, a new study revealed that oil- and gas-producing regions in the continental United States are emitting up to five times more methane than companies are reporting to government regulators.
Discussion
AI Experts & Community
Be the first to comment