Dec 14, 2023
1 new incident, 0 with updates.
Started
- ClosedCriticalPatched
Ledger Connect Kit npm package hijacked to drain crypto wallets
Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.
@ledgerhq/connect-kit (npm)Closed Dec 14, 2023