The Lottie Player Supply Chain Attack Explained

Video transcript

For a few hours in October 2024, a popular animation library became a wallet drainer, delivered through a script sites loaded from someone else.

Attackers used a stolen developer token to publish lottie-player 2.0.5 through 2.0.7. Sites loading it unpinned from a CDN got it automatically, so visitors saw a wallet connect prompt.

There was a tell. The new npm versions had no matching release on GitHub, where the latest was still 2.0.4.

By its timeline, Blockaid's alerts fired seven minutes after 2.0.5 went out. Within hours, LottieFiles shipped a clean 2.0.8 and revoked the developer's tokens.

The total loss is unknown. Scam Sniffer reported at least one victim allegedly lost about 723,000 dollars in Bitcoin. Blockaid detected about 400 affected sites.

Loading latest is a trust decision. Integrity hashes only help when you compute them yourself. One commenter noted CDNJS served 2.0.5 with its own hash, malicious code and all.

Pin exact versions or self-host reviewed copies. Add your own integrity hashes and restrict script sources. Alert when any loaded script changes, and treat an unexpected wallet prompt as an incident.

Guardian's WebApp Pentest covers bundle supply chain and what your frontend trusts from the API. Managed Security matches disclosures to your system in real time, and an engineer helps you patch.

Read the full article for the timeline and checklist, or talk to Guardian at guardian.security.

For a few hours, a popular animation library became a wallet drainer.

DeFi apps and ordinary company sites showed visitors the same prompt to connect a crypto wallet.

The change did not come from those sites' own code. It arrived through a script they loaded from someone else.

What Happened

LottieFiles is a platform for lightweight vector animations that embed in apps and websites. Its lottie-player package is the web player for them.

The npm package had 94,000 weekly downloads and more than 4 million in total, according to The Register.

On October 30, 2024, versions 2.0.5, 2.0.6 and 2.0.7 appeared on npm. The Register notes they were the project's first changes in two months.

LottieFiles says they were published "using a compromised access token from a developer with the required privileges."

Its CTO, Nattu Adnan, told The Register that a highly privileged developer's account was accessed through a stolen session token.

A user opened a GitHub issue that day after a popup appeared on their site. Another noted the latest release on GitHub was still 2.0.4.

So the new npm versions had no matching release on GitHub.

How the Attack Worked

The malicious versions kept the player working. Blockaid found they added "a large blob of web3-related code."

On a live page, that code showed a prompt to connect a crypto wallet.

BleepingComputer tested the script. Clicking the connect button opened a WebSocket to castleservices01[.]com, a domain with a history in crypto phishing.

Blockaid attributed the payload to Ace Drainer, a drainer-as-a-service, based on matching code and communication patterns.

BleepingComputer describes drainers as scripts that, once a wallet connects, try to steal the assets in it.

Why CDN users were hit

Many sites loaded the player from a public CDN without naming a version. The CDN then served whatever npm marked as latest.

LottieFiles' CTO told BleepingComputer that users "via third-party CDNs without a pinned version were automatically served the compromised version."

The same mechanism delivered the fix. Once LottieFiles published a safe version, he said, those users received it automatically.

Integrity hashes only help when you compute them yourself. A commenter in the GitHub thread noted that CDNJS served 2.0.5 with its own hash, malicious code and all.

Timeline and Losses

• October 30, 2024: 2.0.5, 2.0.6 and 2.0.7 are published to npm with the stolen token.
• Minutes later: Blockaid's alerts fire seven minutes after 2.0.5 goes out, by its timeline.
• Same day: Blockaid warns publicly on X and contacts 1inch and LottieFiles.
• Within hours: LottieFiles publishes 2.0.8, based on the clean 2.0.4.
• Within hours: it unpublishes the bad versions and revokes the developer's access and tokens.
• October 31, 04:00 UTC: LottieFiles posts its incident report on GitHub.

LottieFiles brought in an outside incident response team. It said its other open source libraries, GitHub repositories and SaaS were not affected.

What was lost

The total loss is unknown, BleepingComputer reported. It cited Scam Sniffer: at least one victim allegedly lost $723,000 in Bitcoin.

The Register reported that loss as 10 BTC, worth $722,508 when it wrote, and noted LottieFiles had not confirmed it.

Blockaid detected about 400 affected websites and estimates many more were hit. Not all of them were crypto sites.

Per Blockaid, as reported by Cointelegraph, DeFi apps including 1inch and TEN Finance showed the popup.

What It Shows

• "Latest" is a trust decision. An unpinned script tag lets the publisher change your page.
• A publish token is a key. One developer's token shipped code to every unpinned site.
• The package can differ from the repo. npm held versions GitHub never had.
• Outsiders noticed first. Users and a security vendor raised the alarm.

Blockaid compared it to the earlier attack on Ledger's Connect Kit. Read our Ledger Connect Kit explainer and the Polymarket third-party script attack for the same pattern.

Checks for your own frontend

• Pin exact versions of every third-party script, or self-host a reviewed copy.
• Add Subresource Integrity with hashes you compute yourself.
• Limit script-src and connect-src in your Content Security Policy to hosts you name.
• Alert when the hash of any script your pages load changes.
• Treat an unexpected wallet prompt on your site as an incident.
• For packages you publish, limit who holds publish tokens and for how long.

Our guide to dApp frontend supply chain security covers lockfiles, release delays and trusted publishing.

How Guardian Tests This

Guardian's WebApp Pentest covers the client-side surface: XSS, injection, CSRF, bundle supply chain, and what the frontend trusts from the API.

Guardian maps the application function by function at every privilege level, then tests each one. Frontend-only and backend-only scopes are available.

Under Managed Security, Guardian ingests vulnerability disclosures in real time and matches them against your system.

Where one reaches you, an engineer confirms the exposure and works with you to patch it.

Frequently Asked Questions

What was the Lottie Player supply chain attack?

On October 30, 2024, attackers used a stolen developer token to publish lottie-player 2.0.5, 2.0.6 and 2.0.7 to npm. The versions injected a wallet drainer into sites that loaded the player unpinned from CDNs.

Which lottie-player versions were malicious?

LottieFiles says 2.0.5, 2.0.6 and 2.0.7. It removed them from npm and published 2.0.8, based on the clean 2.0.4, and advised everyone on an affected version to upgrade.

How much crypto was stolen?

No total is known. Scam Sniffer reported that at least one victim lost about $723,000 in Bitcoin, per BleepingComputer. The Register noted LottieFiles had not confirmed that figure.

How can a site protect itself from a compromised CDN script?

Pin exact versions or self-host reviewed copies. Add integrity hashes you compute yourself, restrict script and connect sources in your Content Security Policy, and alert when a loaded script changes.

Sources

• GitHub: LottieFiles/lottie-player issue #254, Malicious code in Lottie-Player CDN files, with LottieFiles' incident report (October 30 to 31, 2024)
• BleepingComputer: LottieFiles hacked in supply chain attack to steal users' crypto (October 31, 2024)
• The Register: LottieFiles supply chain attack exposes users to malicious crypto wallet drainer (October 31, 2024)
• Blockaid: Attack Report, Lottie Player supply chain attack (October 30, 2024)
• Cointelegraph: Crypto apps see malicious popups after Ace Drainer hacks animation library (October 31, 2024)
• Guardian: Web Application Penetration Testing
• Guardian: Managed Security