Neural Newscast

Compromised dYdX client packages on npm and PyPI shipped malware that steals crypto wallet seed phrases and, in Python, can run remote commands on infected machines. The core takeaway: if your apps pulled the affected versions, treat it like credential theft plus potential remote access, and rotate keys and wallets from a clean system. Researchers say the poisoned releases were published using legitimate credentials, pointing to a likely maintainer account compromise rather than a registry flaw. The JavaScript package (@dydxprotocol/v4-client-js) focused on wallet credential and device data theft, while the Python package (dydx-v4-client) added a RAT that executes on import and beacons to an external command server. In parallel, CISA issued a binding directive ordering U.S. federal agencies to inventory and replace end-of-support edge devices, warning that perimeter gear with no patches has become a repeatable initial access path. Together, the stories underline a simple pattern: attackers win by owning trusted distribution points—package registries and perimeter infrastructure.