--- title: DyDx keeps getting PWN'd | daily.dev description: DyDx's npm and Python packages were compromised to deliver malware targeting cryptocurrency wallets. The attack involved sophisticated obfuscation with 100... canonical: https://daily.dev/posts/dydx-keeps-getting-pwn-d-tmjz87ehr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DyDx keeps getting PWN'd | daily.dev og:description: DyDx's npm and Python packages were compromised to deliver malware targeting cryptocurrency wallets. The attack involved sophisticated obfuscation with 100... og:url: https://daily.dev/posts/dydx-keeps-getting-pwn-d-tmjz87ehr og:image: https://api.daily.dev/og/posts/TMJZ87eHR.png og:image:alt: DyDx keeps getting PWN'd og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DyDx keeps getting PWN'd **[Eric Parker](https://daily.dev/sources/ericparker)** · 8 min read · 0 upvotes · 0 comments ## Summary DyDx's npm and Python packages were compromised to deliver malware targeting cryptocurrency wallets. The attack involved sophisticated obfuscation with 100 layers in the Python version and a RAT (Remote Access Trojan) that steals private keys. This marks the third security incident for DyDx, highlighting the growing threat of supply chain attacks in the developer ecosystem. Users who installed affected versions should assume complete system compromise and immediately move funds to non-compromised wallets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Top npm package backdoored to drop dirty RAT on dev machines](https://daily.dev/posts/top-npm-package-backdoored-to-drop-dirty-rat-on-dev-machines-cs5su7y7b) · The Register · 0 upvotes · 0 comments - [Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT](https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18) · Snyk · 1 upvotes · 0 comments - [North Korean Hackers Suspected in Supply Chain Attack on Popular Axios Project](https://daily.dev/posts/north-korean-hackers-suspected-in-supply-chain-attack-on-popular-axios-project-zqfdplgvt) · DevOps.com · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#crypto](https://daily.dev/tags/crypto), [#npm](https://daily.dev/tags/npm), [#supply-chain](https://daily.dev/tags/supply-chain) [View this post on daily.dev](https://daily.dev/posts/dydx-keeps-getting-pwn-d-tmjz87ehr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"DyDx keeps getting PWN'd","url":"https://daily.dev/posts/dydx-keeps-getting-pwn-d-tmjz87ehr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/dydx-keeps-getting-pwn-d-tmjz87ehr"},"datePublished":"2026-02-08T02:24:05.714Z","dateModified":"2026-02-08T02:24:43.755Z","description":"DyDx's npm and Python packages were compromised to deliver malware targeting cryptocurrency wallets. The attack involved sophisticated obfuscation with 100...","image":"https://i.ytimg.com/vi/XiNVXdtc9vY/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/XiNVXdtc9vY/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Eric Parker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Eric Parker","logo":"https://media.daily.dev/image/upload/s--vVcOpkjx--/f_auto/v1724391603/logos/ericparker","url":"https://daily.dev/sources/ericparker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/dydx-keeps-getting-pwn-d-tmjz87ehr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,crypto,npm,supply-chain","timeRequired":"PT8M","video":{"@type":"VideoObject","name":"DyDx keeps getting PWN'd","description":"DyDx's npm and Python packages were compromised to deliver malware targeting cryptocurrency wallets. The attack involved sophisticated obfuscation with 100...","thumbnailUrl":"https://i.ytimg.com/vi/XiNVXdtc9vY/sddefault.jpg","uploadDate":"2026-02-08T02:24:05.714Z","duration":"PT8M","url":"https://api.daily.dev/r/TMJZ87eHR","embedUrl":"https://www.youtube.com/embed/XiNVXdtc9vY"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Eric Parker","item":"https://daily.dev/sources/ericparker"},{"@type":"ListItem","position":3,"name":"DyDx keeps getting PWN'd"}]} ```