Mitigating npm Dependency Poisoning: The Lottie-Player Incident and Software Supply Chain Defense

The October 2024 Lottie-Player Supply Chain Compromise

In October 2024, attackers compromised the npm credentials of an authorized maintainer of the popular @lottiefiles/lottie-player library. Within minutes, versions 2.0.5, 2.0.6, and 2.0.7 were published containing malicious JavaScript designed to steal crypto wallet private keys and inject malicious web overlays on thousands of websites worldwide.

Essential Defenses Against Upstream Compromise

• Pin Exact Package Versions: Avoid loose semver ranges (^ or ~) in package.json for production microservices.
• Verify Subresource Integrity (SRI): When loading scripts via CDNs, always enforce cryptographic SHA hashes.
• Use npm ci Instead of npm install: Ensures the build strictly respects the verified package-lock.json without fetching newer upstream updates.