# npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 Exfiltrates Crypto Wallet Seed Phrases and Private Keys

> A compromised maintainer account pushed a malicious commit to the @injectivelabs/sdk-ts npm package (~175,000 monthly downloads) on July 8, 2026, publishing version 1.20.21 with a backdoor disguised as SDK telemetry. The backdoor hooked PrivateKey.fromMnemonic() and PrivateKey.fromHex() to steal BIP-39 seed phrases and raw private keys, base64-encoding them into the X-Request-Id HTTP header and sending them to an attacker-registered domain masquerading as a legitimate Injective testnet gRPC-Web node. The malicious version was live for approximately 49 minutes before a clean release (1.20.23) replaced it.

- **Published:** 2026-07-08T00:00:00Z
- **Last reviewed:** 2026-07-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1149
- **ID:** TL-2026-1149
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 8, 2026 at 20:24:40 UTC, a malicious commit (hash 01219285b16ce85c70cdf47a71a551ff5e41f1ed) was pushed to the InjectiveLabs/injective-ts GitHub repository, modifying packages/sdk-ts/src/core/accounts/PrivateKey.ts. The commit introduced calls to a helper function, trackKeyDerivation(), inside two security-critical key-derivation entry points: PrivateKey.fromMnemonic() (invoked as trackKeyDerivation('fm', words), exfiltrating the complete BIP-39 mnemonic seed phrase) and PrivateKey.fromHex() (invoked as trackKeyDerivation('fh', privateKey), exfiltrating the raw private key when supplied as a hex string). The stolen material was base64-encoded and transmitted inside the X-Request-Id HTTP header of outbound requests, with traffic shaped to resemble gRPC-Web calls so it would blend into legitimate Injective Chain client traffic. The destination endpoint, testnet.archival.chain.grpc-web.injective.network, was not hardcoded as a plain string but assembled at runtime from a character-code array, a lightweight anti-static-analysis obfuscation technique. The domain itself was crafted to impersonate a legitimate Injective testnet archival RPC node.

At 20:59:28 UTC the compromised code shipped to the public npm registry as version 1.20.21. Datadog Security Labs identified the commit as originating from a machine geolocated to the UTC-4 timezone, a pattern that had never previously been observed for that contributor's account, indicating account takeover rather than an insider threat or intentional maintainer action. The npm registry and package ecosystem gave the attacker a distribution channel reaching roughly 175,000 monthly (30,000+ weekly) downloads, meaning any application, wallet tooling, or DApp backend that installed or auto-updated to 1.20.21 during the exposure window and subsequently called the two affected key-derivation functions would have transmitted user secrets to attacker infrastructure that Datadog confirmed was still live and accepting connections at time of publication.

The compromised release was live for approximately 49 minutes: a clean version, 1.20.23, was published at 21:48:03 UTC the same day, and the incident was disclosed publicly via a GitHub issue at 22:07:59 UTC. No CVE has been assigned as of this writing. Because private keys and seed phrases are bearer secrets — anyone who obtains them has unconditional control of the associated wallet(s) — any credential material generated, imported, or handled through version 1.20.21 must be treated as fully compromised and rotated (funds moved to newly generated wallets) regardless of whether outbound network traffic to the C2 domain was directly observed on affected hosts.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1195.001 Compromise Software Dependencies and Development Tools
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1552.001 Credentials In Files
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Not So Anonymous Telemetry: @injectivelabs/sdk-ts Backdoor](https://securitylabs.datadoghq.com/articles/not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor/)
- [@injectivelabs/sdk-ts - npm](https://www.npmjs.com/package/@injectivelabs/sdk-ts)
- [InjectiveLabs/injective-ts GitHub repository](https://github.com/InjectiveLabs/injective-ts)
- [injective-ts issue #697 (public disclosure)](https://github.com/InjectiveLabs/injective-ts/issues/697)
- [Injective Public Endpoints Documentation](https://docs.injective.network/infra/public-endpoints)
- [The npm Threat Landscape: Attack Surface and Mitigations](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/)
- [Supply chain attack compromises npm packages to spread backdoor malware](https://www.csoonline.com/article/4028412/supply-chain-attack-compromises-npm-packages-to-spread-backdoor-malware.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1149