---
title: "With 2FA Enabled: NPM Package lottie-player Taken Over by Attackers"
date: "2024-10-31T13:13:26+00:00"
url: "https://checkmarx.com/blog/with-2fa-enabled-npm-package-lottie-player-taken-over-by-attackers/"
description: "Malicious code by the Lottie-player found in the NPM package, Multifactor authentication - 2FA couldn't prevent the attack."
---

# With 2FA Enabled: NPM Package lottie-player Taken Over by Attackers

The popular NPM package `@lottiefiles/lottie-player` enables developers to seamlessly integrate Lottie animations into websites and applications.

On October 30, the community [reported existence of malicious code](https://github.com/LottieFiles/lottie-player/issues/254) within versions 2.0.5, 2.0.6, and 2.0.7 of the npm package.

The package maintainers [replied and confirmed](https://github.com/LottieFiles/lottie-player/issues/254#issuecomment-2448993225) the attackers were able to take over the NPM package using a leaked **automation token** which was used to automate publications of NPM packages**.**

The malicious code displays a UI overlay, asking to connect the crypto wallets by clicking or scanning a QR. By doing so, this prevent usage of the infected website

This is yet another reminder on how sensitive the software supply chain is

## Would MFA Have Prevented This?

Multifactor authentication is designed to challenge humans. There are three authentication factors that can be used and 2FA requires two:

1. something you know (like a password)
2. something you have (like a one-time-use token)
3. something you are (a biometric identity like a fingerprint or a speech pattern)

Going back two years ago – [NPM decided to enforce 2FA on all users](https://github.blog/news-insights/product-news/enhanced-2fa-experience-for-your-npm-account/). Great move on NPM side as we witnessed [many account takeover incidents](https://checkmarx.com/blog/uaparser-js-attack-preparations/) happening.

![](https://checkmarx.com/wp-content/uploads/2024/10/image-6.png)

## Sounds Great, Doesn’t Work (?)

While this does secure NPM account takeover attacks from the interactive login page, enforcing 2FA on all accounts comes with a side-effect:

- **non-human identities can’t answer 2FA challenges**.

So, when you define an NPM automation token — whoever gets your long-auto generated password is able to bypass your 2FA controls to make new version releases.

Back to `@lottiefiles/lottie-player` , even with 2FA configured, the threat actors somehow got the [NPM automation token set in the CI/CD pipeline](https://github.com/LottieFiles/lottie-player/blob/master/.github/workflows/release.yml#L52-L79) to automate version releases to publish the malicious versions 2.0.5, 2.0.6, and 2.0.7 of the npm package

![](https://checkmarx.com/wp-content/uploads/2024/10/image-7.png)[https://github.com/LottieFiles/lottie-player/blob/master/.github/workflows/release.yml#L52-L79](https://github.com/LottieFiles/lottie-player/blob/master/.github/workflows/release.yml#L52-L79)

## The Malicious Code

All it does is displaying a UI overlay to steer the victim’s focus on connecting its crypto wallets to the malicious interface.

## Conclusion

Kudus to the package maintainers for quickly [releasing an incident response report](https://github.com/LottieFiles/lottie-player/issues/254#issuecomment-2448993225)

Freeze your deps tightly. Don’t rush to update to the latest if it’s not a security update and it’s a new release.

Check and make sure you don’t have the malicious versions `2.0.5`, `2.0.6`, and `2.0.7` of lottie-player npm package.

The incident highlighted limitations of 2FA in automation environments, as automation tokens bypass these controls. This can happen to any major project.

[](https://medium.com/tag/supply-chain?source=post_page-----7d2b7ffde98b--------------------------------)

[](https://medium.com/@jossef?source=post_page---byline--7d2b7ffde98b--------------------------------)