https://pwn.watch/t/wallet-drainer Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 14 Dec 2023 00:00:00 GMT https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023 https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023 Thu, 14 Dec 2023 00:00:00 GMT critical <p>Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 1.1.8</p> <p><strong>Latest updates:</strong></p><ul><li>2023-12-14: Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed (<a href="https://www.ledger.com/blog/security-incident-report">source</a>)</li></ul>