@lottiefiles/lottie-player (npm): compromised developer token used to publish wallet-drainer versions 2.0.5-2.0.7 (no CVE)
Severity: high · Patch status: patched · Since 2024-10-30
On 2024-10-30 three malicious releases of the @lottiefiles/lottie-player web component, 2.0.5 (20:12 UTC), 2.0.6 (20:35 UTC) and 2.0.7 (21:57 UTC), were pushed to npm using a compromised access token belonging to a LottieFiles developer; the company has not said how the token was obtained. Sites that loaded the library from CDNs such as unpkg or jsDelivr without pinning a version were automatically served the new code, which showed visitors a prompt to connect their crypto wallets. LottieFiles removed the developer's access and tokens, published 2.0.8 (a copy of 2.0.4) at 22:58 UTC, and had the bad versions removed on Oct 31; it says its dotLottie player and SaaS services were not affected.
What to do
- Search site templates, HTML and lockfiles for @lottiefiles/lottie-player loaded from unpkg/jsDelivr/cdnjs without a version, and for 2.0.5, 2.0.6 or 2.0.7
- Pin an exact version (2.0.8 or 2.0.4) and add Subresource Integrity to CDN script tags
- Warn users of affected pages from 2024-10-30 20:00-23:00 UTC not to connect wallets and to review recent approvals
- Purge CDN and browser caches of the bad versions
Fixed versions
- @lottiefiles/lottie-player 2.0.8
Sources
All live incidents on Threat Watch
