ClosedCriticalPatched
Ledger Connect Kit npm package hijacked to drain crypto wallets
@ledgerhq/connect-kit (npm)
Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.
Why this severity: npm supply-chain compromise with a crypto drainer
- Started
- Dec 14, 2023
- Closed
- Dec 14, 2023
Affected
- @ledgerhq/connect-kit 1.1.5, 1.1.6, 1.1.7
Fixed in
- 1.1.8
Timeline1
Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed
Source
Advisories2
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
