Compromised lottie-player Versions Injected Malicious Crypto Wallet Prompts
Summary
Attackers reportedly used a maintainer’s stolen token to inject malicious code into lottie-player 2.0.5–2.0.7, prompting wallet connections on affected sites. The versions were removed; sites should update to 2.0.8 or revert to 2.0.4.
Key points
- The article says attackers gained unauthorized access to a lottie-player maintainer’s token and published compromised versions 2.0.5, 2.0.6, and 2.0.7 on October 30, 2024.
- The injected code displayed Web3 wallet connection and signature prompts on sites using the affected library.
- Sites loading the latest release from a CDN without pinning a version could have been served compromised code; the article says 1inch warned users they may have encountered malicious prompts.
- Scam Sniffer reportedly identified a transaction suggesting at least one user lost 10 Bitcoin, valued at $723,436; the article presents this as a report, not independently confirmed.
- The compromised versions were removed from npm and major CDNs, and version 2.0.8 was released.
- Administrators should check dependencies and update to 2.0.8 or revert to 2.0.4; sites explicitly referencing affected versions require an update.
Article Details
- Victim Organization
- 1inch
- Incident Type
- Supply-chain compromise of lottie-player that injected malicious wallet-connection and signature prompts on websites using affected versions.
- Incident Date
- 2024-10-30
- Operational Impact
- Websites using compromised versions remained at risk until they updated or reverted. The article reports that 1inch dApp users may have encountered malicious wallet prompts. Scam Sniffer reported a transaction suggesting at least one user may have lost 10 Bitcoin ($723,436).
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//cdn[.]jsdelivr[.]net/npm/@lottiefiles/[email protected]/dist/lottie-player.min[.]js | Specific CDN URL identified as serving a compromised lottie-player version containing malicious code. |
MITRE ATT&CK
People
Vendors
Products
lottie-playerOn October 30, 2024, a supply chain attack was initiated against the popular JavaScript library lottie-player, injecting malicious code that populates a Web3 wallet connection prompt on legitimate websites using theLottieFiles platformThe Lottie Player component, part of the LottieFiles platform, enables embedding scalable, lightweight animations in apps and websites with minimal performance impact. Widely used across mobile and web applications, it