Injective npm Attack Backdoored 18 Packages to Exfiltrate Wallet Keys

Summary

Step Security says attackers used a trusted maintainer account to publish malicious Injective SDK version 1.20.21 across 18 npm packages, exfiltrating wallet recovery phrases and private keys. Clean 1.20.23 releases followed about 49 minutes later.

Key points

Malicious version 1.20.21 was published across 18 @injectivelabs packages on July 8, 2026; the other 17 packages pulled in the backdoored SDK as an exact dependency.
The payload ran when PrivateKey.fromMnemonic() or PrivateKey.fromHex() was called, collecting seed phrases or string-form private keys.
It batched collected values, base64-encoded them, and sent them in the X-Request-Id header of an HTTPS POST to testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network.
The commits were attributed to an existing maintainer identity and published through the repository’s GitHub Actions trusted-publishing workflow; Step Security says the access pattern is consistent with a compromised account.
A revert removed the payload, and clean version 1.20.23 packages were published about 49 minutes after the malicious releases; version 1.20.21 was deprecated on npm.
The article advises treating wallet secrets used by applications that installed an affected package during the exposure window, or used a cached copy, as exposed.

Article Details

Attack Vectors: Malicious code was pushed directly to the repository's master branch under the identity of a trusted maintainer, with no associated pull request; the article says this pattern is consistent with a compromised legitimate account or bypassed branch protection.
The tainted SDK version 1.20.21 was published through the repository's GitHub Actions trusted-publisher pipeline and automatically propagated to 17 related packages that pinned that SDK version.
At runtime, calls to PrivateKey.fromMnemonic() or PrivateKey.fromHex() triggered collection of key material and sent it in a base64-encoded X-Request-Id header in an HTTPS POST to the attacker-controlled domain.
Defensive Notes: Treat wallet secrets handled by affected packages during the exposure window, or by cached copies, as exposed.
The article reports that all 18 affected packages were republished clean as version 1.20.23 and version 1.20.21 was deprecated.
Search package contents for key-derivation-telemetry.ts, the identified compiled bundle files, and the function names trackKeyDerivation, _enc, _send, and _flush.
Hunt in egress or proxy logs for POST requests with Content-Type: application/grpc-web+proto, an empty body, and a non-empty X-Request-Id header.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network`	Attacker-controlled exfiltration destination used to receive encoded wallet secrets.