https://pwn.watch/t/lottiefiles Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 31 Oct 2024 00:00:00 GMT https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise Thu, 31 Oct 2024 00:00:00 GMT high <p>A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 2.0.8</p> <p><strong>Latest updates:</strong></p><ul><li>2024-10-30: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup (<a href="https://github.com/LottieFiles/lottie-player/issues/254">source</a>)</li><li>2024-10-30: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8 (<a href="https://github.com/LottieFiles/lottie-player/issues/254">source</a>)</li></ul>