npm package report
Is @lottiefiles/lottie-player safe?
Versions 2.0.5, 2.0.6 and 2.0.7 of @lottiefiles/lottie-player were compromised. Other versions are not flagged as malicious.
Do not install @lottiefiles/lottie-player 2.0.5, 2.0.6 or 2.0.7
Compromised releases. Added to CyberXYZ 2024-10-31, OSV malicious-package feed (Google / OpenSSF).
// what we observed
Malicious code in @lottiefiles/lottie-player (npm)
// versions and what to do
- Malicious
- 2.0.5, 2.0.6, 2.0.7
- Move to
- 2.0.12 newest 2.x release, no known advisory
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
npm install @lottiefiles/lottie-player@2.0.12
// reach
4 direct dependencies
none carry a known advisory
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
Checked 2026-10-31 at 00:01 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.