Is It Dead Yet? dependency vitals

xrplnpm

Signals · last 1 check

Commits 90d
16
Open issues
162
Unanswered
114
Contributors
16
State history 1
WhenChange
2026-09-03 first verdict: active
Supply-chain history 1

  1. account hijacked 2025-04 4.2.1–4.2.4, 2.14.2

    Five versions with no matching GitHub release added a checkValidityOfSeed() backdoor that sent wallet seeds and private keys to an attacker domain.

    Patched 4.2.5 and 2.14.3 published; users told to rotate any key the affected code had touched.

    Source: Aikido analysis and the XRPL disclosure, 22 April 2025. History, not a warning about today — the verdict above is about maintenance now.

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/xrpl.svg)](https://isitdeadyet.dev/npm/xrpl)

Watch it

Get told when xrpl changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.