Ledger's NPM account has been hacked

#1

Post by meehow » Thu, Dec 14, 2023, 1:42 PM UTC

Ledger's NPM account has been hacked
github.com

Re: Ledger's NPM account has been hacked

#2

Post by ramijames » Thu, Dec 14, 2023, 2:25 PM UTC

Yikes.

Re: Ledger's NPM account has been hacked

#3

Post by kossTKR » Thu, Dec 14, 2023, 2:33 PM UTC

Ledger has been hacked so many times now i've lost count.

I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one.

Then after deep diving the tech i threw it in the trash, it seemed like security theatre product.

There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if you check their subreddit going back in time.

The more you rely on 3. parties, and the more obfuscated your setup is, the more unsafe your data is. I just use isolated cheap laptops and encrypted usb's now.

Re: Ledger's NPM account has been hacked

#4

Post by binarymax » Thu, Dec 14, 2023, 2:33 PM UTC

NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?

Re: Ledger's NPM account has been hacked

#5

Post by rdl » Thu, Dec 14, 2023, 2:39 PM UTC

binarymax wrote: post #4

NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?

Github action

Re: Ledger's NPM account has been hacked

#6

Post by nathell » Thu, Dec 14, 2023, 2:49 PM UTC

Just yesterday I watched a talk [0] at WarsawJS about LavaMoat [1], a set of tools to protect against malicious behaviour from npm dependencies. Guess it’s time to look into it deeper.

[0]: https://naugtur.pl/pres3/lava/2023end.html

[1]: https://github.com/LavaMoat/LavaMoat

Re: Ledger's NPM account has been hacked

#7

Post by Daviey » Thu, Dec 14, 2023, 2:50 PM UTC

binarymax wrote: post #4

NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?

The Github action leaked the creds, seemingly via a log. Looks like that action has been in use for ~4 months.

Re: Ledger's NPM account has been hacked

#8

Post by beeboobaa » Thu, Dec 14, 2023, 2:52 PM UTC

[flagged]

Re: Ledger's NPM account has been hacked

#9

Post by zaphod420 » Thu, Dec 14, 2023, 2:58 PM UTC

One of the comments on the github issue... https://github.com/LedgerHQ/connect-kit/issues/29

"The @ledgerhq/connect-kit-loader allows dApps to load Connect Kit at runtime from a CDN so that we can improve the logic and UI without users having to wait for wallet libraries and dApps updating package versions and releasing new builds.

This looks like an extremely dangerous approach now, if I understand it correctly, connect-kit-loader trusts whatever the CDN throws at your dApps. So when connect-kit is comprised, all downstream dApps are automatically exposed."

Re: Ledger's NPM account has been hacked

#10

Post by cantSpellSober » Thu, Dec 14, 2023, 3:03 PM UTC

> Yes, .5/.6/.7 versions are compromised

So was there a threat to Ledger users? Elsewhere it's said:

> production build failed