Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware

Researchers discovered that dYdX client packages on npm and PyPI were compromised to deliver malicious versions that steal cryptocurrency wallet seed phrases and device data; the PyPI package additionally installs a RAT that fetches commands from an external server. The actor likely had developer publishing access, enabling coordinated cross-ecosystem deployment, and maintainers and users were urged to isolate affected systems, move funds from clean environments, and rotate credentials; the report also highlights risks from unclaimed/phantom npm package names and provides mitigations.