ClosedHighPatched

@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer

@lottiefiles/lottie-player (npm)

A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.

Why this severity: Malicious npm release served via CDNs

Started: Oct 30, 2024
Closed: Oct 31, 2024

Follow this incident

Updated Oct 31, 2024

Affected

2.0.5
2.0.6
2.0.7

Fixed in

2.0.8

Timeline2

Oct 30, 2024
Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup
Source
Oct 30, 2024
LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8
Source

News & write-ups1

Malicious code in Lottie-Player CDN files (issue #254)GitHub · Oct 30, 2024

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified