We at Blockops Network are committed to ensuring the security and integrity of our technology and services. In light of the recent security breach involving the Ledger’s npm library, we have conducted a thorough investigation and assessment. This blog post outlines our findings and provides crucial information on how our users can safeguard themselves from this and future attacks.

Incident Overview

Severity: Critical

The security incident in question involved the injection of malicious code into Ledger’s npm library. Thankfully, Blockops technology was not directly affected. However, vigilance is paramount. We are meticulously verifying that none of our project modules or their dependencies are compromised.

Timeline and Impact

• Start Time: December 14, 2023

• End Time: December 14, 2023

• Impact: Projects using @connect-kit v1.1.7 library were affected. Blockops dependencies such as “@metamask/eth-sig-util” and “@web3-react/metamask” were assessed for potential risks.

• Who’s Impacted: Blockops Customers using DV-Launchpad.

• How’s Impacted: There is a potential risk to the integrity and security of Blockops and its customers.

Detection and Resolution

The incident was initially detected through various online sources including Twitter and news articles. Our immediate response included a comprehensive review and audit of all dependencies, especially those crucial to our infrastructure like Smart Contracts, and Relay.

Root Cause Analysis

The breach was traced back to a phishing attack on a former Ledger employee, leading to unauthorized NPMJS account access and the publishing of malicious versions of the Ledger Connect Kit. Despite Ledger’s swift response, the malicious file was active for about 5 hours.

Corrective Actions and Lessons Learned

In response, we have taken several corrective measures:

• Conducting a thorough audit of all dependencies.

• Updating any affected dependencies immediately.

• Implementing stricter access control to artifact repositories.

Key lessons include the criticality of continuous monitoring of third-party dependencies and regular security training for all technical teams.

Recommendations for Blockops Users

1. Stay Informed: Regularly check for updates and security advisories from Blockops.

2. Use Dependency Monitoring Tools: Tools like Dependabot, Snyk, and Sonarcloud can help in identifying and updating vulnerable dependencies.

3. Engage in Security Workshops: Participate in our quarterly security workshops to stay aware of best practices and emerging threats.

4. Review and Update Regularly: Regularly review your own dependencies and systems to ensure they are up-to-date and secure.

Conclusion

The Ledger npm attack serves as a stark reminder of the constant vigilance required in the digital age. At Blockops, we are dedicated to maintaining the highest security standards and empowering our users to do the same. Stay safe and stay secure!