Ledger Connect Kit npm package hijacked to drain crypto wallets ยท updates https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023 Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out. en Thu, 14 Dec 2023 00:00:00 GMT Ledger Connect Kit npm package hijacked to drain crypto wallets: Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023 https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023#2023-12-14-6c18d582 Thu, 14 Dec 2023 00:00:00 GMT critical <p><a href="https://www.ledger.com/blog/security-incident-report">Source</a></p>