{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer · updates",
  "home_page_url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise",
  "feed_url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise/feed.json",
  "description": "A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.",
  "language": "en",
  "_pwn": {
    "slug": "lottiefiles-lottie-player-npm-compromise",
    "severity": "high",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise/feed.xml",
    "llms": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise/llms.txt",
    "json": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise#2024-10-30-e83e2ec8",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise#2024-10-30-e83e2ec8",
      "title": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup",
      "content_text": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup\n\nSource: https://github.com/LottieFiles/lottie-player/issues/254",
      "date_published": "2024-10-30T00:00:00.000Z",
      "external_url": "https://github.com/LottieFiles/lottie-player/issues/254",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise#2024-10-30-731c03b5",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise#2024-10-30-731c03b5",
      "title": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8",
      "content_text": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8\n\nSource: https://github.com/LottieFiles/lottie-player/issues/254",
      "date_published": "2024-10-30T00:00:00.000Z",
      "external_url": "https://github.com/LottieFiles/lottie-player/issues/254",
      "tags": [
        "high"
      ]
    }
  ]
}