The @lottiefiles/lottie-player npm Supply Chain Attack

What happened

An attacker published three malicious releases straight to npm, with no GitHub release or code review. LottieFiles states that the attacker took over an employee's npm account by phishing. Snyk and Cycode describe a stolen or exposed npm token. Both descriptions fit the same result: the attacker can publish directly.

Cycode lists the publish times on 30 October 2024 as 20:12 GMT (2.0.5), 20:35 GMT (2.0.6) and 21:57 GMT (2.0.7). Someone opened a public issue about the bad versions about four hours after the first one.

The added code showed a cryptocurrency wallet connection menu. Snyk names MetaMask, WalletConnect and Phantom as the options. Cycode adds that the code included Ethereum functions to run transactions and web3 requests. LottieFiles calls it a Bitcoin drainer. The goal was to take funds from visitors who connected a wallet.

Two groups were exposed. Developers who installed a bad version through npm during the window, and visitors to sites that loaded the package from unpkg, jsDelivr or a similar CDN with the latest tag. LottieFiles states that no customer data, infrastructure or other services were compromised.

Vigilance compares the version you trust with the new one. These three versions changed the package files in a way that added wallet code. Vigilance reports the file that gained a new capability. See the scan block below.

Affected versions

• @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7. npm removed them.
• Safe: 2.0.4 and earlier, and 2.0.8 and later (Snyk).

Indicators of compromise

• Package name and versions above in a lockfile, an npm cache or a CDN URL.
• A "Connect Wallet" menu on a page that only plays Lottie animations.
• CDN links to unpkg.com or cdn.jsdelivr.net for @lottiefiles/lottie-player that use @latest or no version.
• Snyk vulnerability ID SNYK-JS-LOTTIEFILESLOTTIEPLAYER-8310516.

The sources list no wallet-drainer domains or file hashes, so this page lists none.

How to check

Find the installed version in each project.

npm ls @lottiefiles/lottie-player

Then search your source and templates for unpinned CDN links.

grep -rn "lottie-player" --include=*.html --include=*.js --include=*.json . | grep -v node_modules

Any 2.0.5, 2.0.6 or 2.0.7 in a lockfile means a bad version was installed. A CDN link with no version number possibly served it on 30 and 31 October 2024.

What to do now

1. Upgrade to 2.0.8 or later, or go back to 2.0.4. Clear the npm cache and rebuild.
2. Pin the version in every CDN link. Do not use @latest in production.
3. Add a Content Security Policy that limits where scripts can load from.
4. If your site served a bad version, tell your users who connected a wallet during the window. They must check their wallets.
5. Publishers: protect npm accounts with strong two-factor sign-in and use npm provenance.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 66

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    package.json
           It now downloads from the internet and reads saved passwords and access keys. It did not before.

Sources

1. snyk.io/blog/lottie-player-npm-package-compromised-crypto-wallet-theft/
2. cycode.com/blog/lottie-web-player-malicious-package/
3. lottiefiles.com/blog/inside-lottiefiles/resolution-of-security-incident-with-lottiefiles-lottie-player-package