CVE-2023-7345: Incorrect Type Conversion or Cast

Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can...

MSC-2023-18369

@ledgerhq/connect-kit allows web3 apps to connect to Ledger hardware wallets. Versions 1.1.5, 1.1.6, 1.1.7 were compromised by a threat actor to include malicious code that automatically steals crypto and NFT's from wallets that connect to the app. Those versions were deleted and we recommend...

MSC-2023-18368

@ledgerhq/connect-kit allows web3 apps to connect to Ledger hardware wallets. Versions 1.1.5, 1.1.6, 1.1.7 were compromised by a threat actor to include malicious code that automatically steals crypto and NFT's from wallets that connect to the app. Those versions were deleted and we recommend...

MSC-2023-18370

@ledgerhq/connect-kit allows web3 apps to connect to Ledger hardware wallets. Versions 1.1.5, 1.1.6, 1.1.7 were compromised by a threat actor to include malicious code that automatically steals crypto and NFT's from wallets that connect to the app. Those versions were deleted and we recommend...

Malware in @ledgerhq/connect-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8697 Malicious code in @ledgerhq/connect-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f9dd7dd609f844ccf6527b6889709f95fb4f3ada44bc455851bd556e9991762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ledgerhq/connect-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f9dd7dd609f844ccf6527b6889709f95fb4f3ada44bc455851bd556e9991762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ledgerhq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67d11614f406c094801f6dc1d430c496d85b21f41b7c1b02227c3b5a12c10a2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4273 Malicious code in ledgerhq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67d11614f406c094801f6dc1d430c496d85b21f41b7c1b02227c3b5a12c10a2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...