xrpl.js 2.15.0: string entropy no longer yields a spendable zero-seed wallet

Victoria Shinder10 October 2026, 09:462 min read

The XRP Ledger JavaScript library xrpl.js published [email protected] on 8 October, a backport to the 2.x maintenance line of an entropy-validation fix already released in xrpl 5.2.0 and ripple-keypairs 3.1.0.

The bug, from the pull request (#3488):

• Wallet.fromEntropy passed its input through Uint8Array.from(), which accepts any iterable. Strings were coerced via Number(), so letters became NaN and were stored as 0. In the PR's own example, Wallet.fromEntropy('abcdefghijklmnop') returned a real, spendable wallet derived from 16 zero bytes, with no error — a wallet anyone else could derive the same way.
• generateSeed in ripple-keypairs 1.x accepted any entropy of 16 bytes or more and silently used only the first 16, so inputs sharing a prefix produced the same wallet.

After the fix, fromEntropy validates its input instead of coercing it, and generateSeed requires exactly 16 bytes. A Node Buffer still works, since it is a Uint8Array subclass.

Why a backport. According to the PR, the 2.x line still accounts for 37% of weekly xrpl downloads (124,000), and ripple-keypairs 1.x for 35% of weekly ripple-keypairs downloads. The PR also notes that 2.x is based on the 2.14.1 tag because 2.14.2 was the compromised release covered by advisory GHSA-33qr-m49q-rxfx, and 2.14.3 was the clean republish.

How to get it — read this part. On npm, 2.15.0 is published under the dist-tag entropy-2.x-experimental, not latest (which is 5.3.0); equivalent backports exist as 3.2.0 and 4.7.0 under their own tags. A plain upgrade within a ^2 range will pick it up, but nothing pushes it to you automatically if you pin versions.

What to check. If any code path derives XRPL wallets from caller-supplied entropy — seed generators, test tools, custodial onboarding — search it for strings or arrays of the wrong length reaching fromEntropy or generateSeed. Any wallet created that way before the fix may be guessable and should be treated as compromised: move funds to a wallet generated from proper random bytes.

Sources: GitHub release [email protected], 8 October 2026 — https://github.com/XRPLF/xrpl.js/releases/tag/xrpl%402.15.0 ; pull request #3488 — https://github.com/XRPLF/xrpl.js/pull/3488