Ledger Connect Kit (npm): phished ex-employee's npm access used to publish wallet-drainer versions 1.1.5-1.1.7 (no CVE)
Severity: high · Patch status: patched · Since 2023-12-14
On 2023-12-14 an attacker who phished a former Ledger employee, whose npm access had not been revoked at offboarding, published three malicious releases of @ledgerhq/connect-kit (1.1.5 at 08:49 UTC, 1.1.6 at 09:44 UTC, 1.1.7 at 10:37 UTC), bypassing 2FA. Because many dApps load the library from a CDN rather than pinning a version, their visitors saw a fake connect-wallet modal that routed approvals and transfers to the attacker via a rogue WalletConnect project; 1.1.7 embeds the drainer while 1.1.5 and 1.1.6 pull it from a second npm package. Ledger learned of it at 1:45 PM CET and had a genuine 1.1.8 deployed within 40 minutes, WalletConnect disabled the rogue project, and Tether froze some of the attacker's USDT. The bad file stayed live about five hours because of CDN caching, and Ledger puts the draining window under two hours; Sonatype reported over $600,000 stolen early on.
What to do
- Search dApp front ends and bundles for @ledgerhq/connect-kit 1.1.5, 1.1.6 or 1.1.7 and for CDN loads of it without a pinned version; move to 1.1.8 or later pinned with Subresource Integrity
- Users who connected a wallet to an affected dApp on 2023-12-14 should review and revoke token approvals and permits
- Offboarding must revoke package-registry (npm) access, not just corporate SSO
- Require phishing-resistant 2FA for publisher accounts and avoid unpinned CDN loading of wallet code
Fixed versions
- @ledgerhq/connect-kit 1.1.8
Sources
All live incidents on Threat Watch
