Compromised Injective SDK npm Package Exfiltrated Crypto Wallet Keys
Summary
Attackers used a compromised Injective Labs contributor account to publish malicious @injectivelabs/sdk-ts v1.20.21 and related npm packages, which exfiltrated wallet private keys and seed phrases when key-generation or import functions were used.
Key points
- Attackers compromised a legitimate Injective project contributor’s GitHub account and published malicious SDK version 1.20.21 on npm.
- The malware captured wallet private keys and mnemonic seed phrases when SDK functions for generating or importing keys were called; it did not activate merely on installation.
- The stolen secrets were encoded and exfiltrated in an HTTP POST request, according to the researchers.
- The attacker also published the compromised version for 17 related packages, pinning them to the malicious SDK release.
- The legitimate account owner detected and reverted the changes within minutes and released clean version 1.20.23; the malicious package was deprecated but not removed.
- Socket reported 310 downloads of the malicious version before deprecation. Developers who suspect exposure were advised to move funds to new wallets and rotate environment secrets.
Article Details
- Victim Organization
- Injective Labs
- Incident Type
- Software supply-chain compromise involving a breached contributor account and a malicious npm package that stole cryptocurrency wallet secrets.
- Data Types Exposed
- Cryptocurrency wallet private keys
- Mnemonic seed phrases
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Malicious package version 1.20.21 of @injectivelabs/sdk-ts and versions of 17 related packages were published. The malware captured and exfiltrated wallet secrets when relevant SDK functions were used. Socket reported 310 downloads before the package was deprecated; developer systems using the packages may have been compromised, but confirmed victim counts were not disclosed. A clean version, 1.20.23, was released.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe attacker reportedly compromised and used a legitimate project contributor’s GitHub account to make suspicious commits.T1195.002 · Compromise Software Supply ChainThe attacker compromised the project repository and published malicious software packages through npm, constituting a software supply-chain compromise.
Vendors
Products
@injectivelabs/sdk-tsThe supply-chain attack affected @injectivelabs/sdk-ts and related packages, putting developers and users of Injective blockchain tools at risk.Injective blockchainThe supply-chain attack affected @injectivelabs/sdk-ts and related packages, putting developers and users of Injective blockchain tools at risk.Injective SDKInjective SDK is a TypeScript/JavaScript software development kit (SDK) for building applications on the Injective blockchain, a Layer-1 blockchain focused on decentralized finance (DeFi), tokenized assets, and
Industries
BlockchainThe supply-chain attack affected @injectivelabs/sdk-ts and related packages, putting developers and users of Injective blockchain tools at risk.CryptocurrencyHackers compromised the Injective Labs SDK GitHub repository and used it to publish a malicious npm package that stole cryptocurrency wallet private keys and mnemonic seed phrases.Decentralized financekit (SDK) for building applications on the Injective blockchain, a Layer-1 blockchain focused on decentralized finance (DeFi), tokenized assets, and decentralized exchanges.