Hackers Backdoor Injective npm SDK to Steal Crypto Wallet Keys

• Attackers compromised a trusted maintainer’s account and pushed a wallet-stealing backdoor into @injectivelabs/sdk-ts version 1.20.21 on npm on July 8, 2026, spreading it across 18 Injective packages.
• The malware captured full BIP-39 seed phrases and private keys the moment a wallet was created or imported, then exfiltrated them to a domain disguised as legitimate Injective infrastructure.
• The poisoned release was downloaded 310 times before a clean version shipped roughly an hour later, and researchers urge affected developers to move funds to new wallets and rotate every secret.

Attackers backdoored the official Injective npm SDK on July 8, 2026, planting code that stole cryptocurrency wallet private keys and seed phrases from any application that installed the tainted release. The malicious version 1.20.21 of @injectivelabs/sdk-ts reached npm through Injective Labs’ own trusted-publishing pipeline, according to a technical breakdown by StepSecurity. Application security firms Socket, Ox Security, and StepSecurity each flagged the compromise within hours.

The SDK is the standard TypeScript toolkit for building on Injective, a Layer-1 network focused on decentralized finance, tokenized assets, and on-chain exchanges. It records roughly 50,000 weekly downloads and underpins wallets, trading bots, decentralized exchanges, and payment tools. That reach placed the backdoor directly on the code path that handles the most sensitive secret a crypto application holds.

The attacker did not steal an npm publish token or typosquat a package name. Instead, both malicious commits were authored and pushed under the identity of an existing, trusted maintainer, thomasRalee, straight to the repository’s master branch with no pull request.

“That access pattern is consistent with a compromised legitimate account, not a stolen publish token, dependency confusion, or a typosquat,” StepSecurity wrote in its analysis.

The version bump then triggered the project’s GitHub Actions trusted-publisher workflow, which pushed the code to npm automatically.

The payload arrived disguised as a 79-line analytics helper named key-derivation-telemetry.ts, complete with a JSDoc comment claiming it collected “anonymized usage metrics for SDK optimization.” The code hooked into PrivateKey.fromMnemonic() and PrivateKey.fromHex(), the SDK’s canonical functions for turning a seed phrase or raw key into a signing key. Every call handed the attacker the full mnemonic or private key.

To avoid detection, the destination hostname never appeared as plain text. It sat in the file as an array of 48 character codes, reassembled at runtime into testnet.archival.chain.grpc-web.injective.network, a string crafted to resemble genuine Injective gRPC-Web infrastructure. The malware queued captured secrets for two seconds, base64-encoded them, and sent them inside the X-Request-Id header of an HTTPS POST request, mimicking traffic the SDK already generates. Failures were swallowed silently, so nothing surfaced to the calling application.

Automatic publishing carried the exact 1.20.21 version to 18 @injectivelabs packages between 20:59 and 21:00 UTC. The legitimate maintainer caught the compromise within minutes, reverted the changes at 21:16 UTC, and shipped a clean release, version 1.20.23, before 21:50 UTC. The malicious version stayed live for under an hour.

The window still mattered. Socket reported that the poisoned package was downloaded 310 times and was deprecated rather than removed, leaving the malicious GitHub release artifacts online. A report from Ox Security counted 87 dependent packages with a cumulative download count above 112,000, widening the potential blast radius across the ecosystem.

Anyone whose keys passed through the compromised functions should treat those wallets as exposed. Researchers advise affected developers to transfer holdings to new wallets and rotate all secrets in their environment. The incident adds to a run of supply-chain attacks against JavaScript package registries, a pattern that has made hardware wallets and offline key storage a recurring theme in crypto security guidance.

Editorial Note: Reported and edited by the Crypto India Magazine editorial team. We use AI tools to assist with research and drafting; every article is reviewed and fact-checked by our editors.

Interested in advertising with CIM? Talk to us!