Velora identifies and unpublishes malicious npm package version in supply chain attack targeting its DEX aggregator SDK

Velora, a decentralized exchange (DEX) aggregator project, disclosed that one of the npm package versions used for its SDK had been compromised in an npm supply chain attack and that it identified and unpublished the malicious version. The incident is part of a wider wave of critical npm and PyPI compromises in 2025–2026 that use backdoored package versions to steal credentials and spread through developer tooling.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• TanStack & 160+ npm Packages Compromised - Orca Security (orca.security)
• Supply Chain Compromise of axios npm Package - Huntress (huntress.com)
• Active Supply Chain Attack: Malicious node-ipc Versions Published ... (stepsecurity.io)
• Wormable Malware Causing Supply Chain Compromise of npm ... (arcticwolf.com)
• Multiple Supply Chain Attacks against npm Packages (access.redhat.com)

Explore the topic

• DEX
• SDK
• npm