Cosine: Although the poisoned version of Ledger npmjs has been deleted, there are still poisoned js files on jsDelivr

SlowMist founder Yu Xian posted on the X platform that project parties currently need to pay attention to the Ledger Connect Kit vulnerability incident: 1. The poisoned module of Ledger is on the npmjs platform. After the npmjs account of a former employee was hijacked by phishing, the attacker can release poisoned module versions at will. 2. The published module will be automatically updated to jsDelivr CDN. 3. Ledger's Connect Kit directly introduces the jsDelivr CDN js file, which is very crude. There is no file hash binding and no strict restrictions on the imported version. 4. The former employees still left such important permissions. The internal security management mechanism must be strengthened. The worst-case principle, if evil is committed internally, can it be effectively avoided and discovered in time? 5. It should be noted that although the poisoned version of Ledger npmjs has been deleted, there are still poisoned js files on jsDelivr. These security suggestions are for other project parties to learn from. Don’t be lazy. Every security incident is a good opportunity to review yourself.