[URGENT] This repository utilizing malicious version of npm package @ledgerhq/connect-kit, 1.1.7

[0xViva]

https://www.npmjs.com/package/@ledgerhq/connect-kit?activeTab=versions

1.1.7 is a recent update with suspicious source code.

https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1:

https://twitter.com/bantg/status/1735279127752540465

source code gets loaded/used here:

https://github.com/LedgerHQ/connect-kit/blob/main/packages/connect-kit-loader/src/index.ts#L83C49-L83C68

[HenryQW]

Looks like it's the NPM account that is compromised

[Hedonismv]

Yeah, looks like this. btw production build failed

[spuro]

where are my apes

[ItsAditya-xyz]

guys i wanted to sell my bags but scared to connect my ledger what should i do

[Hedonismv]

guys i wanted to sell my bags but scared to connect my ledger what should i do

You can buy module at combine.nfd.gg

[ItsAditya-xyz]

guys i wanted to sell my bags but scared to connect my ledger what should i do

You can buy module at combine.nfd.gg

i clicked on this link where did my coins go??

[Hedonismv]

guys i wanted to sell my bags but scared to connect my ledger what should i do

You can buy module at combine.nfd.gg

i clicked on this link where did my coins go??

If we are talking srsly, do nothing now, thats rly dangerous, wait bro

[misterjame]

What should we check for in repo to see if we are vulnerable ?

dependencies:
  '@coinbase/wallet-sdk': 3.7.2
  '@ledgerhq/connect-kit-loader': 1.1.2

This is my lock file

[Hedonismv]

What should we check for in repo to see if we are vulnerable ?

dependencies:
  '@coinbase/wallet-sdk': 3.7.2
  '@ledgerhq/connect-kit-loader': 1.1.2

This is my lock file

https://www.npmjs.com/package/@ledgerhq/connect-kit?activeTab=versions

[mav-brewlabs]

https://twitter.com/Ledger/status/1735291427100455293

[HenryQW]

The @ledgerhq/connect-kit-loader allows dApps to load Connect Kit at runtime from a CDN so that we can improve the logic and UI without users having to wait for wallet libraries and dApps updating package versions and releasing new builds.

This looks like an extremely dangerous approach now, if I understand it correctly, connect-kit-loader trusts whatever the CDN throws at your dApps. So when connect-kit is comprised, all downstream dApps are automatically exposed.

Here is a list of affected downstream projects: https://sourcegraph.com/search?q=context:global+%40ledgerhq/connect-kit-loader&patternType=standard&sm=0&groupBy=repo

Many familiar names there and I stopped scrolling after seeing wagmi and MetaMask SDK, so, lol.

I wouldn't touch it with a barge pole.

[kewde]

The code attempts to pull in some dependencies that appear to be hosted on an attack controlled domain:

hxxps://browsersjsfiles.com/npm/web3modal.v3.89979e8a.js
hxxps://browsersjsfiles.com/npm/ethereum-tx.min.js
hxxps://browsersjsfiles.com/npm/seaport.min.js

[Hugo0]

The @ledgerhq/connect-kit-loader allows dApps to load Connect Kit at runtime from a CDN so that we can improve the logic and UI without users having to wait for wallet libraries and dApps updating package versions and releasing new builds.

This looks like an extremely dangerous approach now, if I understand it correctly, connect-kit-loader trusts whatever the CDN throws at your dApps. So when connect-kit is comprised, all downstream dApps are automatically exposed.

I wouldn't touch it with a barge pole.

This is absolute INSANITY. They should be shamed. This is fucking nuts

[0xViva]

This issue can be closed now that the malicious source code has been removed with a new version release:

https://github.com/LedgerHQ/connect-kit/releases/tag/ck-v1.1.8

cdn code looks updated, the vulnerability is contained:

https://www.npmjs.com/package/@ledgerhq/connect-kit?activeTab=versions

Team should consider merging this PR however so this can't happen again:

#30

[kluevandrew]

Looks like taht 1.1.6 is also dariner
https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1.1.6

It loads https://cdn.jsdelivr.net/npm/2e6d5f64604be31/2e6d5f64604be31.js it is a drainer

[iskin-hybe]

This issue can be closed now that the malicious source code has been removed with a new version release:

https://github.com/LedgerHQ/connect-kit/releases/tag/ck-v1.1.8

cdn code looks updated, the vulnerability is contained:

https://www.npmjs.com/package/@ledgerhq/connect-kit?activeTab=versions

Team should consider merging this PR however so this can't happen again:

#30

did you find a wallet to where all monies drained?

[meehow]

What should we check for in repo to see if we are vulnerable ?

dependencies:
  '@coinbase/wallet-sdk': 3.7.2
  '@ledgerhq/connect-kit-loader': 1.1.2

This is my lock file

Looks like versions from 1.1.5 to 1.1.7 include maleware.

[kluevandrew]

What should we check for in repo to see if we are vulnerable ?

dependencies:
  '@coinbase/wallet-sdk': 3.7.2
  '@ledgerhq/connect-kit-loader': 1.1.2

This is my lock file

Looks like versions from 1.1.5 to 1.1.7 include maleware.

Confirm 1.1.5 was drainer too

[Sigri44]

Looks like taht 1.1.6 is also dariner https://cdn.jsdelivr.net/npm/@ledgerhq/connect-kit@1.1.6

It loads https://cdn.jsdelivr.net/npm/2e6d5f64604be31/2e6d5f64604be31.js it is a drainer

Yes, .5/.6/.7 versions are compromised !!

[Sigri44]

This issue can be closed now that the malicious source code has been removed with a new version release:
https://github.com/LedgerHQ/connect-kit/releases/tag/ck-v1.1.8
cdn code looks updated, the vulnerability is contained:
https://www.npmjs.com/package/@ledgerhq/connect-kit?activeTab=versions
Team should consider merging this PR however so this can't happen again:
#30

did you find a wallet to where all monies drained?

Yae :

https://debank.com/profile/0x658729879fca881d9526480b82ae00efc54b5c2d
&
https://debank.com/profile/0x412f10AAd96fD78da6736387e2C84931Ac20313f
&
https://debank.com/profile/0x634984866301511696AC3fdC41Fa4700e11609CE

[misterjame]

too

Looks like my RainbowKit (via wagmi) projects were using connect-kit-loader which appears to arbitrarily load javascript in the browser from a CDN which includes compromised code.

[misterjame]

The @ledgerhq/connect-kit-loader allows dApps to load Connect Kit at runtime from a CDN so that we can improve the logic and UI without users having to wait for wallet libraries and dApps updating package versions and releasing new builds.

This looks like an extremely dangerous approach now, if I understand it correctly, connect-kit-loader trusts whatever the CDN throws at your dApps. So when connect-kit is comprised, all downstream dApps are automatically exposed.

I wouldn't touch it with a barge pole.

That is how I read it. Anybody who used any version in a certain time period is potentially compromised.

[apbendi]

Something I'm still unclear on that it would be great to get some clarity on is whether the fact the CDN was compromised—and the package was apparently loading code from CDN (good grief!)—means that frontends using the pre-compromised versions are safe or not. I.e. was a frontend that is using version 1.1.4 or earlier at any point serving malicious code? And is there any risk it still is? And what is the correct course of action for anyone running such a frontend? Sit tight for the moment, or upgrade immediately.

[misterjame]

Something I'm still unclear on that it would be great to get some clarity on is whether the fact the CDN was compromised—and the package was apparently loading code from CDN (goof grief!)—means that frontends using the pre-compromised versions are safe or not. I.e. was a frontend that is using version 1.1.4 or earlier at any point serving malicious code? And is there any risk it still is? And what is the correct course of action for anyone running such a frontend? Sit tight for the moment, or upgrade immediately.

Seems to me the CDN was definitely compromised. So whatever -loader version you were running seems irrelevant. What a serious mis-step.

[specialOne-coder]

WTF

[Jo-Chris]

npm ls --all to quickly dump your dependencies and search there. Even without finding something, I'd not touch that thing for the next couple of days.

[misterjame]

npm ls --all to quickly dump your dependencies. Even without finding something, I'd not touch that thing for the next couple of days.

From what I can tell you are looking for connect-kit-loader. If you have any version of that it was loading arbitrary code from a CDN that was temporarily compromised earlier today.

[AdamK222]

Is the CDN file fixed already?

[Jo-Chris]

Is the CDN file fixed already?

heres the chore: a4ba694

[justTil]

It seems weird that this issue, which might have existed in previous versions, has only now been reported, especially given its potential impact on user funds. Why wasn't this exploit used before?

[misterjame]

It seems weird that this issue, which might have existed in previous versions, has only now been reported, especially given its potential impact on user funds. Why wasn't this exploit used before?

Seems like they gained access to npm which pushed out some new versions that got hosted on CDN.

[jfbloom22]

I concur @misterjame. It would be amazing to be able to warn my community with exactly what the time frame is. I could warn them, "If you have used your Ledger to interact with any of these projects {list of projects} from {start date} through Dec 14, 2023, you should consider that wallet compromised."

The best list of projects I see so far is what @HenryQW shared: https://sourcegraph.com/search?q=context:global+%40ledgerhq/connect-kit-loader&patternType=standard&sm=0&groupBy=repo

[justTil]

I concur @misterjame. It would be amazing to be able to warn my community with exactly what the time frame is. I could warn them, "If you have used your Ledger to interact with any of these projects {list of projects} from {start date} through Dec 14, 2023, you should consider that wallet compromised."

The best list of projects I see so far is what @HenryQW shared: https://sourcegraph.com/search?q=context:global+%40ledgerhq/connect-kit-loader&patternType=standard&sm=0&groupBy=repo

Some of them use fixed versions, which may have "saved" them if the exploit was introduced later.

[apbendi]

Time is ticking by and afaik there has still not been a clear statement from Ledger for dapp devs to know if our frontends were impacted and what, if any, actions are required to rectify the issue. How is that possible? Could we please get a clear statement on the right course of action?

[AdamK222]

https://twitter.com/Ledger/status/1735326240658100414

[specialOne-coder]

[frostworx]

Would make sense to leave an official statement here as well

[apbendi]

The latest official statement on Twitter helps but still doesn't answer clearly what I consider the most important questions for dapp devs:

1. Does this mean a frontend that had connect-kit-loader as a transitive dependency (for example via wagmi via RainbowKit) would have served the malicious code for several hours?
2. Should developers of such apps take any action right now? i.e. do we need to update connect-kit loader?

[jfbloom22]

Thanks @AdamK222 for pointing to the announcement on Twitter.

Do I understand this correctly: The fix is out, but because of the potential for client side caching, it is best to clear cache and wait until tomorrow before using Ledger to interact with a project. The fix is out because it is being loaded via a CDN. The effected projects don't need to do anything, however it is still a good idea for them to update to the latest version of @ledgerhq/connect-kit, 1.1.8.

[alexksso]

Thanks @AdamK222 for pointing to the announcement on Twitter.

Do I understand this correctly: The fix is out, but because of the potential for client side caching, it is best to clear cache and wait until tomorrow before using Ledger to interact with a project. The fix is out because it is being loaded via a CDN. The effected projects don't need to do anything, however it is still a good idea for them to update to the latest version of @ledgerhq/connect-kit, 1.1.8.

Not exactly, it depends how the dependency was bundled in the project. Most of the time, a given version is bundled into the project's code, so to be safe the project needs to update its dependency version to latest and rebuild/deploy.

[robertsdotpm]

The CDN thing is kind of horrible from a security perspective. With apps like this the typical approach would be to have every dependency frozen and third-party deps scrutinized. In this case there's something interesting though that might have helped: the idea of including a hash of remote content to fetch. If your front-end code remains in-tact because its on another delivery mechanism but you're including CDN content. You can embed the file's hash and discard any data that's been changed.

Apparently the mechanism is implemented in most browsers now already. It's called 'subresource integrity.' More info here - https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity Could help harden against similar attacks in the future. I always find it funny that many of these blockchain projects don't actually use much crypto.

[DoctorLai]

I may miss something here, but could anybody educate me why this occurs, I guess there is code review, right?

[alexksso]

@DoctorLai the ccode here is fine, but the packaged built on the code was modified on npm, where all the other projects pull their dependencies from.

[brianddk]

I may miss something here, but could anybody educate me why this occurs, I guess there is code review, right?

1. An authorized publisher deployed a drainer in @ledgerhq/connect-kit
2. Ledger included a reference to @ledgerhq/connect-kit in @ledgerhq/connect-kit-loader without freezing the version at 1.1.4 or 1.1.8
3. A former employee maintained pubhlishing rights to @ledgerhq/connect-kit after they left the company
4. The former employee had their publishing account sufficiently weak for a spear fishing attack to work.

Most of these could be insulated from each other if freezing was used, credentials were cycled and proper OPSEC was used. But you put all 4 togeather and it looks to have lead to a 5 hour exploit on many wallets who included dependencies on @ledgerhq/connect-kit without versioning, or depended on @ledgerhq/connect-kit-loader in general.

[eightsixeight]

maybe have 2 user authentication for pushes ? or devel that ? maybe basic security training for ledger employes ./.... how can i security company fall for basic phish tactics... out of this world... going to ngrave instead

[hx8888979]

I believe using a signature for each version is a good idea to avoid similar things. verify resource before loaded

[W3stside]

hilarious how decentralisation was founded with one of the core principles being to AVOID bullshit like this. Using a weak CDN to serve extremely sensitive code, jfc @LedgerHQ wtf are you doing? Incredibly stupid.

[ComradeAERGO]

Thanks to everyone for providing feedback.

We just merged version 1.1.8 of the connect-kit-loader that is tethered to version 1.1.8 of the connect-kit.

From here, we'll now deprecate the connect-kit-loader and advise developers to setup connect-kit manually from npm.

Future versions of connect-kit won't be accessible from the loader.

[NikolayKash]

Why don't use integrity attribute of script element https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity ?
like script.integrity = <original script sha> and place it after this line

connect-kit/packages/connect-kit-loader/src/index.ts

Line 99 in c58c838

script.src = src;

[stayForward09]

So we can't use any kind of version of @ledgerhq/connect-kit-loader module? then what is the safest and best way to connect ledger wallet?

[atillabirer]

thanks just sold my ledger