Malicious code in Lottie-Player CDN files

[MrAhmedSayedAli]

after i use
https://unpkg.com/@lottiefiles/lottie-player@latest/dist/lottie-player.js
or
https://cdn.jsdelivr.net/npm/@lottiefiles/lottie-player@2.0.5/dist/lottie-player.min.js

This popup opens on my site.

[cassianogf]

Up

[franciscoaguilars]

Up

[bnt4]

Up

[MrAhmedSayedAli]

When i open google Dev Tools

[bnt4]

You can use Ctrl + F8 to disable breakpoints, then the debugger doesn't "stop" the website and you can use the dev tools normally.

[SergejKembel]

npm versions of this lib got updated few minutes ago https://www.npmjs.com/package/@lottiefiles/lottie-player?activeTab=versions

There is malicious code in last 2 versions. I think the NPM token for deployment was leaked somehow

[MrAhmedSayedAli]

You can use Ctrl + F8 to disable breakpoints, then the debugger doesn't "stop" the website and you can use the dev tools normally.

[andres-frank]

up

[bnt4]

npm versions got updated not even one hour ago; https://www.npmjs.com/package/@lottiefiles/lottie-player?activeTab=versions

as @SergejKembel said, virus seems to be in version 2.0.5 and higher.

[tomoconnor]

[MrAhmedSayedAli]

https://cdnjs.cloudflare.com/ajax/libs/lottie-player/2.0.4/lottie-player.js Work Fine For Now

[edelciomolina]

Same here!
If you search for 'Ethereum,' you'll see many references to cryptocurrency wallets.

https://unpkg.com/@lottiefiles/lottie-player@latest/dist/lottie-player.js

I chose to stop using it! Fortunately, we didn’t rely on it much!

[lukasnobody]

Just switched to airbnb lib.

Lottiefiles, i'm sorry but you're just like an French TV channel with credentials on the wall)

[lukasnobody]

npm versions got updated not even one hour ago; https://www.npmjs.com/package/@lottiefiles/lottie-player?activeTab=versions

as @SergejKembel said, virus seems to be in version 2.0.5 and higher.

There is no 2.0.5 or 2.0.6 versions at all. 2.0.4 latest (on github) for 8 months, lol...