npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 Exfiltrates Crypto Wallet Seed Phrases and Private Keys

npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 (TL-2026-1149) is a critical-severity supply-chain compromise, first published 2026-07-08. It has no confirmed attribution, affects Injective Labs @injectivelabs/sdk-ts, maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-1149

Threat ID
TL-2026-1149
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-08
Last reviewed
2026-07-08
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency, defi, blockchain, fintech, web3-development, software-supply-chain
Target regions
Global
Detection rules
9
Indicators of compromise
20

A compromised maintainer account pushed a malicious commit to the @injectivelabs/sdk-ts npm package (~175,000 monthly downloads) on July 8, 2026, publishing version 1.20.21 with a backdoor disguised as SDK telemetry. The backdoor hooked PrivateKey.fromMnemonic() and PrivateKey.fromHex() to steal BIP-39 seed phrases and raw private keys, base64-encoding them into the X-Request-Id HTTP header and sending them to an attacker-registered domain masquerading as a legitimate Injective testnet gRPC-Web node. The malicious version was live for approximately 49 minutes before a clean release (1.20.23) replaced it.

How npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 works

On July 8, 2026 at 20:24:40 UTC, a malicious commit (hash 01219285b16ce85c70cdf47a71a551ff5e41f1ed) was pushed to the InjectiveLabs/injective-ts GitHub repository, modifying packages/sdk-ts/src/core/accounts/PrivateKey.ts. The commit introduced calls to a helper function, trackKeyDerivation(), inside two security-critical key-derivation entry points: PrivateKey.fromMnemonic() (invoked as trackKeyDerivation('fm', words), exfiltrating the complete BIP-39 mnemonic seed phrase) and PrivateKey.fromHex() (invoked as trackKeyDerivation('fh', privateKey), exfiltrating the raw private key when supplied as a hex string). The stolen material was base64-encoded and transmitted inside the X-Request-Id HTTP header of outbound requests, with traffic shaped to resemble gRPC-Web calls so it would blend into legitimate Injective Chain client traffic. The destination endpoint, testnet.archival.chain.grpc-web.injective.network, was not hardcoded as a plain string but assembled at runtime from a character-code array, a lightweight anti-static-analysis obfuscation technique. The domain itself was crafted to impersonate a legitimate Injective testnet archival RPC node.

At 20:59:28 UTC the compromised code shipped to the public npm registry as version 1.20.21. Datadog Security Labs identified the commit as originating from a machine geolocated to the UTC-4 timezone, a pattern that had never previously been observed for that contributor's account, indicating account takeover rather than an insider threat or intentional maintainer action. The npm registry and package ecosystem gave the attacker a distribution channel reaching roughly 175,000 monthly (30,000+ weekly) downloads, meaning any application, wallet tooling, or DApp backend that installed or auto-updated to 1.20.21 during the exposure window and subsequently called the two affected key-derivation functions would have transmitted user secrets to attacker infrastructure that Datadog confirmed was still live and accepting connections at time of publication.

The compromised release was live for approximately 49 minutes: a clean version, 1.20.23, was published at 21:48:03 UTC the same day, and the incident was disclosed publicly via a GitHub issue at 22:07:59 UTC. No CVE has been assigned as of this writing. Because private keys and seed phrases are bearer secrets — anyone who obtains them has unconditional control of the associated wallet(s) — any credential material generated, imported, or handled through version 1.20.21 must be treated as fully compromised and rotated (funds moved to newly generated wallets) regardless of whether outbound network traffic to the C2 domain was directly observed on affected hosts.

MITRE ATT&CK techniques used in TL-2026-1149

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1132.001 Standard Encoding

Initial Access

T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools

Credential Access

T1552 Unsecured Credentials; T1552.001 Credentials In Files

Persistence

T1554 Compromise Host Software Binary

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Impact

T1657 Financial Theft

Affected products and versions in npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21

  • Injective Labs — @injectivelabs/sdk-ts
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23

Remediation for npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21

Patches

  • Upgrade @injectivelabs/sdk-ts to version 1.20.23 or later immediately; do not pin to 1.20.21 under any circumstance.

Immediate actions

  • Identify all systems, CI pipelines, and applications with @injectivelabs/sdk-ts version 1.20.21 installed (query lockfiles/SBOMs for the exact pinned version).
  • Treat every mnemonic seed phrase or private key that was ever passed to PrivateKey.fromMnemonic() or PrivateKey.fromHex() while 1.20.21 was installed as fully compromised.
  • Rotate/regenerate all affected wallets: generate new key material and migrate all funds/assets to the new addresses immediately.
  • Block or monitor egress to testnet.archival.chain.grpc-web.injective.network at DNS and network perimeter layers.
  • Hunt for outbound requests containing base64-encoded data in the X-Request-Id HTTP header, especially traffic disguised as gRPC-Web to *.injective.network destinations.
  • Revoke and re-issue any npm publish tokens/credentials for the injectivelabs maintainer account suspected of compromise.

Workarounds

  • If immediate upgrade is not possible, vendor/lock the last known-good pre-compromise version (1.20.20) and manually audit PrivateKey.ts before use.
  • Avoid calling PrivateKey.fromMnemonic()/PrivateKey.fromHex() with production secrets on any host that has ever installed 1.20.21 until a full credential rotation is complete.

Longer-term hardening

  • Enforce npm package-lock integrity checking (npm ci with lockfile hash verification) and pin exact dependency versions rather than caret/tilde ranges for security-sensitive SDKs.
  • Adopt Software Bill of Materials (SBOM) generation and continuous dependency diffing to flag unexpected code changes in patch releases.
  • Require hardware-token-backed MFA and provenance attestation (e.g., npm provenance / Sigstore) for all maintainer publish actions on packages handling cryptographic key material.
  • Isolate key-derivation and signing logic in offline/air-gapped or hardware-wallet contexts rather than general-purpose npm SDKs whenever handling production private keys or mnemonics.
  • Monitor for anomalous publish behavior (timezone/geolocation shifts, unusual commit timing) on packages with privileged registry access.

Weaknesses (CWE) in npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21

CWE-506, CWE-912, CWE-311, CWE-522

Timeline of npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21

  • Datadog Security Labs published technical analysis of the backdoor, confirming the C2 domain testnet.archival.chain.grpc-web.injective.network remained live and accepting requests at time of publication.
  • The affected maintainer publicly acknowledged the security incident at 22:19:00 UTC, confirming the account/commit compromise.
  • A community member publicly disclosed the compromise by opening GitHub issue #697 on the injective-ts repository at 22:07:59 UTC.
  • Clean, malware-free version 1.20.23 published to npm at 21:48:03 UTC, ending the active-compromise window on the registry approximately 49 minutes after 1.20.21 went live.
  • Clean release commit bf2f323 for version 1.20.23 created at 21:44:53 UTC.
  • Manual version bump to 1.20.22 (commit 4c37b4a) performed at 21:41:24 UTC as an intermediate remediation step before the final clean release.
  • A failed release-pipeline attempt for version 1.20.21 (commit 42a5a83) occurred at 21:20:30 UTC, part of the remediation effort following the reversion commit.
  • Reversion commit 7c4b1a092d8cbbcda469bda5a88db2a742d15b4a pushed at 21:16:32 UTC, removing the malicious trackKeyDerivation() calls and rolling back the backdoored code in the repository.
  • Compromised version 1.20.21 of @injectivelabs/sdk-ts published to the public npm registry at 20:59:28 UTC, beginning the ~49-minute exposure window during which any installer would receive the backdoored PrivateKey.ts.
  • Release commit c826399 initiated at 20:56:33 UTC to build and deploy the compromised version 1.20.21 to npm.
  • Additional formatting-correction commit 5486f13 pushed at 20:54:02 UTC touching the same problematic code introduced by the backdoor commit.
  • Follow-up commit fd105db pushed at 20:48:14 UTC addressing formatting issues in the file containing the malicious payload, extending the attacker's window of activity on the repository.
  • Malicious commit 01219285b16ce85c70cdf47a71a551ff5e41f1ed pushed to InjectiveLabs/injective-ts at 20:24:40 UTC, modifying PrivateKey.ts to add credential-exfiltrating telemetry calls (trackKeyDerivation) and the obfuscated C2 endpoint construction.

Sources cited for npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21

Threats related to npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21

Detection coverage for TL-2026-1149

As of 2026-07-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1149 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats