Ledger Connect-Kit Supply Chain Attack Hits Decentralized C...

A supply chain attack on the Ledger Connect Kit, a tool used to link crypto wallets with decentralized applications, resulted in crypto fund theft and underscored the efficacy of Socket's AI scanner in identifying such threats. The attack involved a malicious version of the software that diverted funds to an attacker's wallet, affecting versions 1.1.5 to 1.1.7, after a former Ledger employee's npmjs account was compromised via phishing. Ledger responded quickly to the breach, deploying a fix within 40 minutes, although the malicious file was active for about five hours, affecting users for less than two hours. The incident led to security enhancements, including restricting direct npm package pushes to read-only for the development team and rotating internal secrets. Despite having 21 maintainers and a relatively modest download rate, the Ledger Connect Kit is crucial for safeguarding financial transactions, which makes this breach particularly concerning. The attack highlighted the rapidity with which software can be compromised and distributed, emphasizing the need for vigilance in securing npm account credentials. Socket's AI scanner proved effective in detecting the threat, suggesting its potential as a real-time protection tool for repositories on platforms like GitHub.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.