Ledger Connect Kit npm supply-chain attack

On 14 December 2023 malicious versions 1.1.5, 1.1.6 and 1.1.7 of Ledger Connect Kit, a JavaScript library websites use to connect to wallets, were published to npm. Ledger states that a former employee fell victim to phishing, and the attacker used a session token to bypass two-factor authentication on that person’s npm account, which had not been revoked when the employee left. Ledger says the attacker never had access to Ledger infrastructure.

The injected code drained funds from users of third-party dApps that loaded the library by prompting them to sign malicious transactions; Ledger’s report names Angel Drainer. According to The Block, projects including Kyber and Revoke.cash disabled their front ends, and MetaMask said users of every wallet were affected, not only Ledger owners.

Ledger says it deployed the fix within 40 minutes of becoming aware, that the malicious file stayed reachable for about five hours because of CDN caching, and that funds were drained for less than two hours. Tether froze the attacker’s USDT and WalletConnect disabled the project used in the drain. Ledger states the exploit did not affect Ledger hardware or Ledger Live.

What Ledger advises:

• Check every transaction on the device screen before approving it; what the device shows is what you sign.
• Never approve a transaction you did not initiate.