Malicious @injectivelabs/sdk-ts Release Was Designed to Exfiltrate Wallet Keys
Summary
Aikido reports that @injectivelabs/sdk-ts 1.20.21 captured wallet mnemonics and private keys and sent them through disguised requests. Seventeen other republished packages pinned to the release could expose users transitively.
Key points
- Aikido's analysis found malicious code in @injectivelabs/sdk-ts 1.20.21, published June 8, 2026; the version was available for under an hour before the maintainer reverted the change and published clean version 1.20.23.
- Hooks in PrivateKey.fromMnemonic and PrivateKey.fromHex captured seed phrases and raw private keys when applications derived wallet keys.
- The code batched and base64-encoded captured data, then sent it in the X-Request-Id header to hxxps://testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network/ while imitating gRPC-web traffic.
- Seventeen other @injectivelabs packages were republished at version 1.20.21 with a dependency pinned to the compromised SDK, enabling transitive exposure.
- The payload ran when keys were derived at runtime, not during installation, so scanners focused only on install-time scripts could miss it.
- The report says npm recorded 310 downloads of the malicious version. At the time of the report, it was deprecated but still downloadable and compromised release artifacts remained available.
- The article recommends upgrading affected dependencies to 1.20.23 and moving funds and rotating mnemonics or keys that passed through the packages.
Article Details
- Attack Vectors
- A malicious release of @injectivelabs/[email protected] introduced wallet-key-stealing code into its build artifacts.
- The attacker republished 17 other @injectivelabs packages at version 1.20.21 with hard dependency pins to the compromised SDK, enabling transitive installation.
- Hooks in PrivateKey.fromMnemonic and PrivateKey.fromHex captured seed phrases and raw private keys when applications derived wallet keys.
- The payload sent queued, timestamped key data in a base64-encoded X-Request-Id header to an attacker-controlled endpoint, disguising the request as gRPC-web traffic.
- The report says commits came from a GitHub account with an established repository history, which it interprets as pointing to account takeover.
- Defensive Notes
- Upgrade affected @injectivelabs packages pinned or resolvable to 1.20.21 to the clean 1.20.23 release.
- Treat any mnemonic or private key processed by the affected packages as exposed; move funds and rotate the associated keys and seed phrases.
- Check dependency trees for transitive installations of @injectivelabs/[email protected], not only direct dependencies.
- The report states the malicious version was deprecated but remained downloadable and that compromised release artifacts remained on the project's GitHub releases page.
- The report recommends triggering a manual Aikido rescan rather than relying on its nightly rescans.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0 | SHA-256 of the malicious dist/cjs/accounts-Cy0p4lLW.cjs build artifact. |
| SHA256 | 9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9 | SHA-256 of the malicious dist/esm/accounts-jQ1GSgaW.js build artifact. |
| URL | hxxps[:]//testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network/ | Attacker-controlled exfiltration endpoint used to receive stolen wallet-key data. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload stored the exfiltration hostname as character codes and reconstructed it at runtime to hide it from plain-text searches.T1036 · MasqueradingThe exfiltration hostname was shaped to resemble Injective gRPC-web infrastructure, and the payload framed key collection as anonymized telemetry.T1041 · Exfiltration Over C2 ChannelThe payload exfiltrated captured mnemonics and private keys to an attacker-controlled endpoint in an HTTP request header.T1071.001 · Web ProtocolsThe payload used HTTPS requests and a gRPC-web content type to transmit stolen key data while blending with application network traffic.T1195.002 · Compromise Software Supply ChainThe attacker published a poisoned @injectivelabs/sdk-ts release and republished 17 scoped packages with dependency pins that pulled in that compromised SDK.