Injective Neutralizes Malicious Threat Without User Impact

Compromised Developer Account Triggers npm Supply Chain Attack

@Injective Labs moved quickly to contain a software supply chain attack after hackers compromised a developer's GitHub account and used it to publish a malicious version of the protocol's TypeScript SDK on npm.

Security firm Socket detected a malicious @injectivelabs/sdk-ts@1.20.21 release published to npm with fake telemetry functionality that exfiltrates wallet private keys and mnemonic phrases. The malicious functionality was introduced through commits submitted by a GitHub account belonging to a developer with an established history of contributions to the repository.

The bad version, 1.20.21, was live on npm for under an hour on June 8, 2026, before the maintainer noticed and published a clean fix. The threat actor also published version 1.20.21 across 17 additional @injectivelabs scoped packages that depended on and pinned the malicious SDK version, exposing transitive users who may not have installed @injectivelabs/sdk-ts directly.

The malware activates when developers use SDK functions that generate or import wallet keys, rather than upon installation. Once those functions are called, the malware captures the full mnemonic seed phrase and private key and encodes the data in base64, exfiltrating it via an HTTP POST request to an Injective Labs public infrastructure endpoint to make the traffic appear legitimate.

Protocol Response and User Fund Safety

Injective CEO Eric Chen confirmed the affected npm releases had been deprecated and the issue was fixed, adding that no funds on the Injective network were at risk. No confirmed number of affected wallets has been released, and there is no public evidence that funds were stolen. The incident did not involve a breach of the Injective blockchain itself.

Independent security researchers, however, noted the response was not without caveats. Socket reported the malicious version of the package was downloaded 310 times before it was deprecated, not removed, and the malicious GitHub release artifacts remain available. Socket recommended upgrading to version 1.20.23, reviewing dependency chains, and treating any wallet credentials processed by the compromised releases as fully compromised.

The incident is part of a broader pattern targeting crypto developer tooling. Wallet compromises were the costliest crypto attack method in the first half of 2026, accounting for $444 million stolen across 33 cases, according to CertiK. Rather than attacking the blockchain directly, attackers targeted a trusted software component used by developers, a method commonly described as a software supply chain attack.

Sources:
Socket: Compromised Injective SDK npm Package Exfiltrates Wallet Keys
BleepingComputer: Injective SDK on npm Infected with Cryptocurrency Wallet Stealer
CoinTelegraph: Injective NPM Package Hacked to Steal Crypto Wallet Keys