Compromised Ledger Connect Kit releases distribute wallet-draining code to decentralized applications

On 14 December 2023, an attacker phished a former Ledger employee's npm publishing access and released malicious versions of the legitimate Ledger Connect Kit library. Downstream decentralized applications dynamically loaded the tainted software and displayed wallet-draining transaction prompts to users, resulting in stolen digital assets. Ledger reported that malicious versions remained accessible for approximately five hours and expressly stated that its internal infrastructure and source-code repositories were not breached.