Leaked credential on paste/sentry site
dYdX v4 (dYdX Chain)'s assessment for RD-F-164 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
The Jan 2026 supply-chain attack involved developer account credential compromise for npm/PyPI publishing. The mechanism (credential stuffing, phishing, or paste-site credential reuse) is not confirmed per Socket.dev report. No specific evidence of credentials appearing on paste sites or Sentry-alt instances has surfaced in public sources. Requires proprietary paste-monitoring feed for formal assessment.
Sources #
- URLMalicious dYdX Packages Published to npm and PyPI — attack vector analysisSocket.dev — attack vector described as developer account compromise, method unconfirmedretrieved 2026-05-17
Methodology #
Determine whether a public paste site, Sentry-alt, or credential-dump references protocol infrastructure endpoints or API keys.
See the full factor methodology and distribution across all protocols →