dYdX Malicious Infrastructure Connection

Ethan Andrews@eandrews

•updated Feb 23, 2026•3•0•36

This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.