Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Supply chain attack on lottie-player: everything you need to know

wiz.io | incident | #supply-chain | #web3 | #npm | #javascript | #incident | #lottie-player

Summary

Wiz analyzes the lottie-player supply chain attack: malicious versions 2.0.5–2.0.7 prompted Web3 wallet drains after a maintainer token was compromised, impacting 1inch via CDN-hosted copies.
Published
Collected

original ↗

Related coverage

  1. Ultralytics AI Library Hacked via GitHub for Cryptomining (wiz.io)
  2. Shai-Hulud Rises From the Dead after 111 days (aikido.dev)
  3. PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting (crowdstrike.com)
  4. From DEF CON Research to Automated Supply Chain Defense, finding npx confusion vulnerabilities with npxconfuse (lab.ctbb.show)
  5. Supply chain attacks: a new era (osec.io)
  6. keyv and cacheable npm Package Hijacked in Supply Chain Attack (wiz.io)

back