LottieFiles
Security incidents tagged LottieFiles. Newest first.
0 LottieFiles incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 722
- Longest quiet run: 722 days (Oct 31–Oct 22)
Show 1 older incident1 older incident
October 2024 1
Patched@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer
@lottiefiles/lottie-player (npm)
A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.
