Cryptocurrency

Injective

Impact

Security

Safety

<h2 id="compromised-developer-account-triggers-npm-supply-chain-attack">Compromised Developer Account Triggers npm Supply Chain Attack</h2>
<a href="https://x.com/Injective" rel="noopener noreferrer nofollow">@Injective</a> Labs moved quickly to contain a software supply chain attack after hackers compromised a developer's GitHub account and used it to publish a malicious version of the protocol's TypeScript SDK on npm.
<cite>Security firm Socket detected a malicious <a href="https://x.com/injectivelabs" rel="noopener noreferrer nofollow">@injectivelabs</a>/sdk-ts<a href="https://x.com/1" rel="noopener noreferrer nofollow">@1</a>.20.21 release published to npm with fake telemetry functionality that exfiltrates wallet private keys and mnemonic phrases.</cite><cite>The malicious functionality was introduced through commits submitted by a GitHub account belonging to a developer with an established history of contributions to the repository.</cite>
<cite>The bad version, 1.20.21, was live on npm for under an hour on June 8, 2026, before the maintainer noticed and published a clean fix.</cite><cite>The threat actor also published version 1.20.21 across 17 additional <a href="https://x.com/injectivelabs" rel="noopener noreferrer nofollow">@injectivelabs</a> scoped packages that depended on and pinned the malicious SDK version, exposing transitive users who may not have installed <a href="https://x.com/injectivelabs" rel="noopener noreferrer nofollow">@injectivelabs</a>/sdk-ts directly.</cite>
<cite>The malware activates when developers use SDK functions that generate or import wallet keys, rather than upon installation. Once those functions are called, the malware captures the full mnemonic seed phrase and private key and encodes the data in base64, exfiltrating it via an HTTP POST request to an Injective Labs public infrastructure endpoint to make the traffic appear legitimate.</cite>
<h2 id="protocol-response-and-user-fund-safety">Protocol Response and User Fund Safety</h2>
<cite>Injective CEO Eric Chen confirmed the affected npm releases had been deprecated and the issue was fixed, adding that no funds on the Injective network were at risk.</cite><cite>No confirmed number of affected wallets has been released, and there is no public evidence that funds were stolen. The incident did not involve a breach of the Injective blockchain itself.</cite>
Independent security researchers, however, noted the response was not without caveats. <cite>Socket reported the malicious version of the package was downloaded 310 times before it was deprecated, not removed, and the malicious GitHub release artifacts remain available.</cite><cite>Socket recommended upgrading to version 1.20.23, reviewing dependency chains, and treating any wallet credentials processed by the compromised releases as fully compromised.</cite>
The incident is part of a broader pattern targeting crypto developer tooling. <cite>Wallet compromises were the costliest crypto attack method in the first half of 2026, accounting for $444 million stolen across 33 cases, according to CertiK.</cite><cite>Rather than attacking the blockchain directly, attackers targeted a trusted software component used by developers, a method commonly described as a software supply chain attack.</cite>
Sources: <a href="https://socket.dev/blog/compromised-injective-sdk-npm-package" rel="noopener noreferrer nofollow">Socket: Compromised Injective SDK npm Package Exfiltrates Wallet Keys</a> <a href="https://www.bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer/" rel="noopener noreferrer nofollow">BleepingComputer: Injective SDK on npm Infected with Cryptocurrency Wallet Stealer</a> <a href="https://cointelegraph.com/news/hackers-compromise-injective-npm-package-with-malware-to-steal-wallet-keys" rel="noopener noreferrer nofollow">CoinTelegraph: Injective NPM Package Hacked to Steal Crypto Wallet Keys</a>

Injective Neutralizes Malicious Threat Without User Impact

Table of Contents

BSCN

Other articles published on Jul 10, 2026

Join our free newsletter for daily crypto updates!