14 Dec 2023
Ledger Connect Kit: Phished NPM Account Published Malicious Packages
Ledger: on 14 Dec 2023 a phished former employee NPM account published malicious Connect Kit versions 1.1.5–1.1.7 that could reroute dApp transactions. Fix within ~40 minutes; hardware and Ledger Live unaffected.
- Event date
- Incident typeSupply-chain compromise
- Bug classSupply chain
- Published
Loss, as sourced
Not stated as a total by Ledger in its security incident report. Ledger says hardware wallets and Ledger Live were not affected.
Traceability
Primary sources
In brief
Root cause: Per Ledger: former employee phished; NPMJS access used to publish malicious @ledgerhq/connect-kit versions that affected third-party dApps integrating the kit.
Timeline, as sourced: Per Ledger: 14 Dec malicious versions 1.1.5–1.1.7 published; fix deployed within about 40 minutes; malicious package reachable longer (~5 hours) while active draining window shorter (~2 hours), per contemporaneous reporting Ledger engages.
Account, as sourced
Claimed (Ledger) (incident report (opens in a new tab)): Connect Kit supply-chain event; devices and Ledger Live not compromised.
Users interacting with affected dApps during the window may have signed malicious payloads.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/ledger-connect-kit-npm-2023