Megathread: Lottiefiles plugin / canvasUI compromised (crypto popups in apps)

LA81638 · 2024-10-30T21:14:12.219Z

I don’t use the plugin and use this code but it happened to me too, just in case it does affect anyone else

ryan8 · 2024-10-30T21:16:24.042Z

i have no popups left on my app?? are you still getting them

liquidredsnake · 2024-10-30T21:16:50.978Z

Did you block them with your script?

nur.ibrayev · 2024-10-30T21:17:12.745Z

Had the same issue. Seems that lottie people fixed it up.

ryan8 · 2024-10-30T21:17:27.563Z

yes worked on mine

Bennn · 2024-10-30T21:17:29.374Z

Bro how are you guys accessing your apps

ian11 · 2024-10-30T21:17:47.188Z

I added the original code you published above and it seemed to resolve it for me. Waiting for other people to confirm.

fede.bubble · 2024-10-30T21:18:33.135Z

status page is up

status.bubble.io

Bubble Status

Welcome to Bubble's home for real-time and historical data on system performance.

ryan8 · 2024-10-30T21:19:04.609Z

i had the original code work for a bit, but there is a 2nd initialization in the malicious code that caused to to relaunch so i had to had a 2nd observer. Make sure to add:

/* Hide by default */ w3m-modal { display: none !important; visibility: hidden !important; }

dorilama · 2024-10-30T21:19:24.212Z

georgecollier:

or the plugin author’s fault

the author should have pinned the version in the url instead of loading the latest version every time. this way the plugin would have loaded the exact version that the author used when building and testing instead of the new compromised version.
Using the latest version is meant for development, not production.

georgecollier · 2024-10-30T21:20:44.122Z

dorilama:

the author should have pinned the version in the url

Hahaha yeah I mentioned that here

georgecollier:

This is partly why I’ll always die on the ‘avoid plugins if we can’ hill Closely followed by the ‘download the plugin JS and save it with Bubble so it can’t be modified’ hill.

(or pin the version)

dorilama · 2024-10-30T21:21:17.984Z

I am still going through the topic

bwm561 · 2024-10-30T21:24:24.272Z

I guess I feel slightly better that Bubble itself is compromised by the Canvas reliance

ian11 · 2024-10-30T21:25:06.630Z

I’ve just added it. Waiting to see.

LA81638 · 2024-10-30T21:27:25.196Z

@ryan8 should we all be adding this? I had Lottie html code (which I’ve removed) and don’t have the other plugins mentioned in the thread but it has just shown up again.

If so where do I add this code?

ryan8 · 2024-10-30T21:27:47.310Z

go to the header in the general setting of bubble under the SEO section

marchdigital3 · 2024-10-30T21:28:07.437Z

Awesome! Thanks - this works (for now).

fede.bubble · 2024-10-30T21:28:45.635Z

LA81638 · 2024-10-30T21:29:22.775Z

And add to the bottom of this then deploy?

Screenshot 2024-10-30 at 21.28.43566×266 5.05 KB

luigi.grossi · 2024-10-30T21:29:43.356Z

I removed the lottie plugin and it solved it for me… not sure why others are saying it does not work for them.