Backdoor discovered in XRPL NPM package versions 4.2.1 to 4.2.4, stealing private keys—users warned not to upgrade from earlier versions.