Slow Mist: Dapps using Ledger Connect Kit 1.1.4 or above are affected, please pay attention to troubleshooting

December 14, 2023 8:33 PM SlowMist Security Threat Intelligence found that @ledgerhq/connect-kit suffered a supply chain attack. The attacker implanted malicious JS code in version @ledgerhq/connect-kit > 1.1.4 thereby launching phishing attacks against cryptocurrency users. Dapps using @ledgerhq/connect-kit version >1.1.4 are affected. Please check whether the following affected versions are used in the troubleshooting code. Affected version range: @ledgerhq/connect-kit 1.1.5 (The attacker left a message in the code) @ledgerhq/connect-kit 1.1.6 (The attacker leaves a message in the code and implants malicious JS code) @ledgerhq/connect-kit 1.1.7 (The attacker leaves a message in the code and implants malicious JS code) The SlowMist security team recommends that you use DApps for interactive operations with caution until there is no clear official fix.