"Lottie-Player Supply Chain Attack Targets Cryptocurrency Wallets"

LottieFiles has recently confirmed that its Lottie-Player software has been compromised in a supply chain attack aimed at stealing cryptocurrency from victims. LottieFiles’ Lottie-Player is widely used for embedding and playing Lottie animations on websites. Recently, users of Lottie-Player complained that their websites had been displaying a pop-up prompting visitors to connect their cryptocurrency wallet.  The goal was apparently to get users to connect their crypto wallets in an attempt to drain them.  LottieFiles quickly launched an investigation and determined that a threat actor had pushed out several malicious versions of an open-source NPM package for the web player. It was noted that while the company rushed to remove the malicious versions, they had already been pushed out to a large number of users via third-party CDNs, and at least one victim lost a significant amount of cryptocurrency as a result of the phishing attack. The company said the attacker created the malicious Lottie-Player after taking over an employee’s NPM account following a phishing attack.  The employee’s laptop has been quarantined pending an investigation.  The threat actor leveraged an access token belonging to this developer to publish versions 2.0.5, 2.0.6, and 2.0.7 of Lottie-Player to npmjs.com over the course of an hour.  A safe version (2.0.8) was published just hours after discovering the incident.

SecurityWeek reports: "Lottie-Player Supply Chain Attack Targets Cryptocurrency Wallets"