The risk of supply chain attacks in open source projects cannot be ignored. Recently, the security community has discovered that some malicious open source dependency packages are stealing users' Private Keys and API Secret Keys by hiding toxic code. Such attacks often bury malicious logic deep within the third-party dependency layers of the project, making it difficult to detect any signs by simply reviewing the main project's Source Code.

For Web3 developers, such risks are particularly dangerous—once the Private Key is leaked, assets can be transferred in an instant. As a defensive strategy, it is recommended to prioritize open source libraries that are trustworthy, have an active community, and maintain good records. For core encryption logic and Secret Key management modules, the safest approach is to reimplement them yourself rather than directly relying on them. In addition, measures such as regularly scanning dependency package versions, using code audit tools, and limiting dependency permissions are also worth implementing.