Archived tweet

Tweet thread by bantg:

ledger library confirmed compromised and replaced with a drainer. wait out interacting with any dapps till things become clearer. https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1… Tweeted at 7:42 AM · Dec 14, 2023 seems ledger connect-kit-loader is also vulnerable since it specified the dep loosely https://github.com/LedgerHQ/connect-kit/blob/main/packages/connect-kit-loader/src/index.ts#L83… possible list of affected parties https://sourcegraph.com/search?q=context:global+@ledgerhq/connect-kit&patternType=standard&sm=1&groupBy=repo… Tweeted at 1h ledger asks to use connect-kit loader to load connect-kit, but even if you follow the best practices and pin the version of the loader loader, it fetches the latest version of connect-kit >=1.0.0, <2.0.0. this has allowed the attackers to infiltrate a shitton of libraries by… Tweeted at 1h ledger pushed a new version, @1 should match 1.1.8 now. https://github.com/LedgerHQ/connect-kit/releases/tag/ck-v1.1.8… it still doesn't add strict version pinning, which is better addressed here. https://github.com/LedgerHQ/connect-kit/pull/30… the version is still not on npm yet though and it doesn't guarantee the fix if the attacker can… Tweeted at 1h cdn code looks updated, the vulnerability is contained. Tweeted at 1h

Tweet #1

Image #1:

Image

Links:

Tweet #2

Links:

Tweet #4

Links: