Threat actors compromised an authorized developer’s npm access token to publish poisoned releases (versions 2.0.5, 2.0.6, and 2.0.7) of the widely used @lottiefiles/lottie-player JavaScript animation library. By leveraging a stolen automation token, the attackers bypassed two-factor authentication and standard CI/CD code review controls, pushing obfuscated code directly to the public registry. Downstream web applications that loaded the library dynamically via public CDNs (such as unpkg and jsDelivr) using unpinned version ranges or @latest tags automatically fetched and executed the malicious scripts on client endpoints.

The injected payload dynamically evaluated a Web3 crypto wallet drainer script upon DOM initialization. The malware intercepted user interactions and rendered rogue connection modals mimicking legitimate providers like WalletConnect and MetaMask to trigger fraudulent transfer transactions, draining tokens and NFTs from connected wallets. Blockchain forensics traced at least $723,000 in stolen digital assets to attacker-controlled addresses. LottieFiles revoked the compromised developer credentials, unpublished the tainted package versions, and released sanitized version 2.0.8, confirming that core SaaS platforms and GitHub repositories remained unaffected.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unpinned CDN script tags execute unauthenticated, dynamic code directly in browser origins, transforming developer token compromise into instant client-side execution that bypasses corporate network perimeters and local repository integrity checks.
• Bullet 2 — Strategic & Defender Imperative: Engineering teams must strictly enforce Subresource Integrity (SRI) hashes or pin immutable package versions in production, restrict npm publish tokens to granular time-limited scopes, and deploy Content Security Policy (CSP) directives to constrain outbound Web3 RPC calls.