LottieFiles has confirmed that its Lottie-Player software has been compromised in a supply chain attack whose goal was to steal cryptocurrency from victims. 

LottieFiles’ Lottie-Player is widely used for embedding and playing Lottie animations on websites. 

Users of Lottie-Player complained this week that their websites had been displaying a pop-up prompting visitors to connect their cryptocurrency wallet. The goal was apparently to get users to connect their crypto wallets in an attempt to drain them. 

LottieFiles quickly launched an investigation and determined that a threat actor had pushed out several malicious versions of an open source NPM package for the web player. 

While the company rushed to remove the malicious versions, they had already been pushed out to a large number of users via third-party CDNs and, according to reports, at least one victim lost a significant amount of cryptocurrency as a result of the phishing attack. 

According to LottieFiles, the attacker created the malicious Lottie-Player after taking over an employee’s NPM account following a phishing attack. The employee’s laptop has been quarantined pending an investigation. 

The threat actor leveraged an access token belonging to this developer to publish versions 2.0.5, 2.0.6 and 2.0.7 of Lottie-Player to npmjs.com over the course of an hour. A safe version (2.0.8) was published just hours after the incident was discovered.

“Preliminary investigations revealed that LottieFiles open source libraries, code, GitHub repos and SaaS were not impacted, but we continue to perform a full inventory and audit of all systems, credentials and code bases,” LottieFiles said.

In response to the incident, the company revoked its developers’ access to NPM repositories and revoked NPM keys.

Related: North Korean APT Exploited IE Zero-Day in Supply Chain Attack

Related: Polyfill Supply Chain Attack Hits Over 100k Websites 

Related: Several Plugins Compromised in WordPress Supply Chain Attack