Skip to content

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

← Live incidents

Dec 14, 2023

1 new incident, 0 with updates.

Started

  • ClosedCriticalPatched

    Ledger Connect Kit npm package hijacked to drain crypto wallets

    Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.

    @ledgerhq/connect-kit (npm)Closed Dec 14, 2023