@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer ยท updates https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4. en Wed, 30 Oct 2024 00:00:00 GMT @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise#2024-10-30-e83e2ec8 Wed, 30 Oct 2024 00:00:00 GMT high <p><a href="https://github.com/LottieFiles/lottie-player/issues/254">Source</a></p> @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8 https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise#2024-10-30-731c03b5 Wed, 30 Oct 2024 00:00:00 GMT high <p><a href="https://github.com/LottieFiles/lottie-player/issues/254">Source</a></p>