A roundup of the week\u2019s most important cybersecurity news.<\/p>\n
Attackers compromised accounts of developers at the decentralised crypto exchange dYdX and injected malware into official software packages (npm and PyPI). Researchers at Socket discovered<\/a> the breach.<\/p>\n The npm and PyPI packages are used by programmers to work with the exchange\u2019s protocols, including creating wallets and executing trades. As billions of dollars flow through dYdX, the threat was severe.<\/p>\n The target was wallet seed phrases. Once a developer interacted with an infected library, the malware copied access keys and sent them to the attackers\u2019 server. The culprits used website addresses that looked almost identical to the exchange\u2019s official domains.<\/p>\n For developers using the Python version, matters were worse: a remote-access trojan was installed. Running in the background every ten seconds, it allowed the attackers to execute arbitrary code on the victim\u2019s machine, enabling the theft of cryptocurrency, passwords and personal files, and monitoring of user activity.<\/p>\n Socket\u2019s specialists noted the intruders understood the system\u2019s internals, hiding malicious code deep within legitimate, automatically executed files.<\/p>\n After the alert, the exchange confirmed the breach and urged anyone who downloaded updates in January 2026 to isolate affected computers immediately and move funds to new, secure wallets.<\/p>\n 1\/ IMPORTANT SECURITY ANNOUNCEMENT \u2014 READ IF YOU HAVE USED VERSIONS OF DYDX-V4 CLIENTS HOSTED ON PyPI or NPM.<\/p>\n \u2014 dYdX (@dYdX) January 29, 2026<\/a><\/p><\/blockquote>\n \n