Ledger Wallet's LedgerHQ/connect-kit hit by supply chain attack | Hacker News Reader

Ledger Wallet's LedgerHQ/connect-kit hit by supply chain attack

coindesk.com

63 pointsraghavsood16 comments

A backdoored version of the package was pushed to NPM using leaked credentials from a GitHub Action[1] - this has been removed now[2].

[1]: https://twitter.com/bytes032/status/1735287204241461634

[2]: https://twitter.com/Ledger/status/1735291427100455293

Beware the term 'now' when CDNs are involved.

It is concerning (although not surprising, I suppose) that they wouldn't have the option enabled to make it so that new contributors' PRs won't run github actions without approval.. although I guess without further detail on exactly what happened it is possible they do and someone who previously contributed did it which would've made that mitigation useless

So presumably they didn't even bother to sign their library to make sure that users can verify that it is an authorised build? This is exactly the kind of security practices that I expect from the so-called crypto "industry".

but gpg is "complicated" I wouldn't even know how to verify the signature! Instead, I'd rather my wallet be drained instead of RTFM.

I've been going through the mallicous (obfuscated) js file and the sheer volume of tokens, swaps and NFT's it drains is impressive.

I would say that part isn't new, a lot of phishing websites hardcode many addresses and method signatures. or they retrieve it from a server or even IPFS

Interplanetary File System drainer, I like this century.

https://github.com/LedgerHQ/connect-kit/issues/29

^ the actual github issue.

Code is law. I welcome our new overlords.

this guy had a hack in front of every dapp and only made $500,000

thats like 1 bored ape at the top of last bull market

pretty good testament to this industry and how it reacts

this is a good place for the state to help in the crypto asset space, package maintenance and approval. it wouldn't be mandatory, just allow the market to choose between the public-private partnership packages, and non-standard ones. people could vet products based on it passing certain criteria, and then if that criteria fails anyway there is an easier path of tracking accountability

Is this supposed to be a joke? That is among a short list of very bad things you dont want to happen. Yea, the government can help steal your money, they are the pros afterall, maybe they can even provision their own cryptocurrency, its called slavery coin.

The "crypto industry" has plenty of quality products to pick from, they just need to accept that none of them save for bitcoin has security. People will have to learn the hard way.

strawman arguments aim to discredit one concept by introducing concepts nobody ever suggested

which is what you wrote

Of course you didnt suggest it, that is the logical conclusion of the government getting involved in custody.

but i didn’t say a single thing about custody

my entire comment was about package management and nested software dependencies, what did you even read

Right, the government can be expected to remain totally neutral, theyll never abuse their power, who would ever do such a thing?

Reply on news.ycombinator.com