Compromised LottieFiles npm package distributes crypto drainer to downstream websites

On 30 October 2024, an attacker used a phished LottieFiles developer npm account to publish malicious versions 2.0.5, 2.0.6 and 2.0.7 of the legitimate @lottiefiles/lottie-player package. Websites configured to pull the latest package version through public CDNs automatically received the malicious code, which displayed cryptocurrency-wallet prompts. LottieFiles removed the affected versions and published a clean release; Blockaid detected roughly 400 affected websites and reported that additional sites were likely impacted.