Supply Chain Attack on lottie-player (Campaign)

On October 30, 2024, attackers gained access to a maintainer token for the lottie-player JavaScript library and pushed malicious versions (2.0.5–2.0.7) that injected Web3 wallet connection prompts into legitimate websites. The compromised packages were distributed via npm and major CDNs, leading to active impact (notably 1inch dApp users), after which affected versions were removed and a safe release (2.0.8) was published; sites explicitly referencing the malicious versions remain at risk.