ChainCatcher message, SlowMist Security Threat Intelligence discovered that @ledgerhq/connect-kit has suffered a supply chain attack, where the attacker implanted malicious JS code in versions of @ledgerhq/connect-kit >1.1.4 to launch phishing attacks against cryptocurrency users. Dapps using @ledgerhq/connect-kit version >1.1.4 are all affected, please check if the following affected versions are used in your code.Affected version range:@ledgerhq/connect-kit 1.1.5 (the attacker left a message in the code)@ledgerhq/connect-kit 1.1.6 (the attacker left a message in the code and implanted malicious JS code)@ledgerhq/connect-kit 1.1.7 (the attacker left a message in the code and implanted malicious JS code)The SlowMist Security Team recommends exercising caution when interacting with DApps until an official fix is clearly provided.

ChainCatcher news, according to reports from Wu, based on the Github information of PayPal's stablecoin PYUSD, Paxos is able to suspend the authorization and transfer functions of PYUSD in the event of a serious security threat. Additionally, due to regulatory requirements, Paxos must have an asset protection role to freeze or seize the assets of offenders when legally required, so addresses with AssetProtectionRole permissions can initiate freezing/unfreezing or even wiping the balances of any accounts, allowing relevant authorities to seize their assets.However, Paxos stated that it will not execute freezing operations on its own and that such situations are expected to be rare. It is understood that mainstream stablecoins USDT & USDC also have similar blacklist freezing mechanisms.