Apparently, Ledger is in the news again for the wrong reasons.
At first, SuchiSwap CTO (one of the leading DEXs) made a tweet about the suspected vulnerability.
The primary issue is that the Ledger ConnectKit NPM package Library that is used across majority of decentralized applications was updated few hours ago with malicious code (drainer):
How come?
It looks like the NPM key was leaked via a github action which means Anyone can invoke the action via a PR on Ledger's GitHub Orgs, then leak that key by crafting a malicious package.json.
Right now, any user interacting with any and all Dapps could potentially be exposed to the vulnerability and end up losing all funds to drainers. According to my research so far, it doesn't include users who are just using Ledger for day-to-day transfers with no interactions and prior interactions before the vulnerability was disclosed appears to good.
Side note: This only shows how poorly the Ledger team takes security and their continued negligence of the security of their products and services.
Update #1:
Ledger has confirmed the vulnerability report:🚨We have identified and removed a malicious version of the Ledger Connect Kit. 🚨
A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves.
Your Ledger device and Ledger Live were not compromised.
