{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T23:13:41.393Z",
  "tag": {
    "id": "ledger",
    "label": "Ledger",
    "isStack": false,
    "url": "https://pwn.watch/t/ledger",
    "feed": "https://pwn.watch/t/ledger/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "ledger-connect-kit-npm-supply-chain-2023",
      "title": "Ledger Connect Kit npm package hijacked to drain crypto wallets",
      "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023",
      "json": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "@ledgerhq/connect-kit (npm)",
      "tags": [
        "npm",
        "node",
        "ledger",
        "supply-chain",
        "crypto",
        "wallet-drainer",
        "phishing"
      ],
      "cveIds": [],
      "affectedVersions": [
        "@ledgerhq/connect-kit 1.1.5, 1.1.6, 1.1.7"
      ],
      "fixedVersions": [
        "1.1.8"
      ],
      "startedAt": "2023-12-14",
      "closedAt": "2023-12-14",
      "updatedAt": "2023-12-14",
      "summary": "Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "ledger-connect-kit-npm-supply-chain-2023",
      "incidentTitle": "Ledger Connect Kit npm package hijacked to drain crypto wallets",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-14",
      "title": "Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed",
      "body": null,
      "sourceUrl": "https://www.ledger.com/blog/security-incident-report",
      "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023"
    }
  ]
}