The “xrpl.js” JavaScript library, widely used and recommended for interacting with the XRP Ledger, was recently compromised in a sophisticated software supply chain attack aimed at stealing users’ private keys and cryptocurrency wallet seed phrases. Malicious code was introduced into five (5) specific versions—2.14.2 and 4.2.1 through 4.2.4—via a function named “checkValidityOfSeed”, which covertly transmitted sensitive wallet data to an attacker-controlled domain disguised as ad traffic. This backdoor, inserted during the npm publishing process, exploited a developer account linked to Ripple, likely through stolen credentials, and did not affect the GitHub repository or the XRP Ledger codebase itself. The attack has been assigned CVE-2025-32965 (CVSS score: 9.3/10), and although the compromised versions were downloaded only 452 times, the risk is far-reaching due to the library’s widespread use in managing XRP wallets. Users are urgently advised to update to the secure versions 4.2.5 or 2.14.3 and rotate any potentially exposed private keys or seeds. The incident mirrors previous attacks on Ethereum and Solana libraries, highlighting the escalating threat of supply chain compromises targeting the cryptocurrency ecosystem. CTIX strongly urges any affected readers to update and follow the mitigation guidance to prevent exploitation.