Oct 30, 2024
1 new incident, 0 with updates.
Started
- ClosedPatched
@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer
A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.
@lottiefiles/lottie-player (npm)Closed Oct 31, 2024
