npm Supply Chain Attack: @injectivelabs/sdk-ts v1.20.21 and 17 Sibling Packages Infected with Cryptocurrency Wallet Stealer

npm Supply Chain Attack (TL-2026-1153), also tracked as Injective npm Supply Chain Attack, is a high-severity supply-chain compromise, first published 2026-07-09. It has no confirmed attribution, affects InjectiveLabs @injectivelabs/sdk-ts, maps to 27 MITRE ATT&CK techniques (T1005, T1027, T1027.010), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-1153

Threat ID
TL-2026-1153
Also known as
Injective npm Supply Chain Attack, Injective SDK Wallet Stealer
Severity
HIGH
Status
MITIGATED
Category
SUPPLY_CHAIN
First published
2026-07-09
Last reviewed
2026-07-09
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency, defi, finance, software-development
Target regions
Global
Detection rules
9
Indicators of compromise
20

A compromised GitHub maintainer account (thomasRalee) was used to push malicious commits directly to master, publishing a backdoored v1.20.21 of @injectivelabs/sdk-ts and 17 dependent @injectivelabs scoped packages via an automated GitHub Actions trusted-publisher workflow. The payload exfiltrated BIP-39 mnemonic seed phrases and raw private keys, base64-encoded and smuggled inside an HTTP request header disguised as legitimate Injective gRPC-web telemetry, whenever SDK consumers generated or imported wallet keys.

How npm Supply Chain Attack works

On 2026-07-08 an attacker with write access to the GitHub account `thomasRalee` — a trusted, existing maintainer of the InjectiveLabs/injective-ts monorepo with direct push permissions to master — committed a new file, `src/utils/key-derivation-telemetry.ts`, and wired its `trackKeyDerivation()` function into the static `PrivateKey.fromMnemonic()` and `PrivateKey.fromHex()` methods inside `PrivateKey.ts`. Both malicious commits landed directly on master with no associated pull request, indicating either a bypassed branch-protection rule or full write access consistent with account takeover rather than a stolen npm publish token, dependency confusion, or typosquatting.

The payload intercepted the full BIP-39 mnemonic phrase or raw hex private key the instant a consumer application called wallet-generation or wallet-import functions — before legitimate key-derivation logic executed. Captured secrets were formatted as `{method}:{value}:{timestamp}` (e.g. `fm:wallet phrase:1783975179000`), base64-encoded via `Buffer.from(s,'utf-8').toString('base64')` in Node or `btoa(s)` in browser contexts, and queued in a 2-second `setTimeout` window so multiple captured keys/mnemonics from a single session could be pipe-delimited (`|`) and batched into one exfiltration request rather than firing per-capture (evading simple rate-based detections).

The exfiltration endpoint was `https://testnet.archival.chain.grpc-web.injective.network/`, a domain that mimics legitimate Injective Labs public infrastructure naming conventions so closely that it blends into normal SDK network traffic. The hostname itself was not hardcoded as a plain string but obfuscated as a JavaScript numeric character-code array and reconstructed at runtime via `String.fromCharCode()`, defeating simple static grep-for-domain scans. The exfiltration HTTP POST carried `Content-Type: application/grpc-web+proto` to visually mimic legitimate Injective gRPC-web calls, an empty request body, and the base64-encoded stolen secret placed entirely inside the `X-Request-Id` header — a location unlikely to be inspected or logged by standard web/network security tooling that focuses on request bodies.

A GitHub Actions trusted-publishing (OIDC) workflow auto-published the compromised code to npm as soon as a version-bump commit landed, meaning the attacker did not need a separate stolen npm token — control of the GitHub account alone was sufficient to reach the npm registry for all 18 packages within minutes. The malicious v1.20.21 release went live across the entire @injectivelabs 1.20.21 release train (sdk-ts plus 17 packages pinning that exact sdk-ts version) and remained live for approximately 49-50 minutes before the same account (thomasRalee) authored a revert commit and the maintainers republished a clean v1.20.23. During the exposure window the malicious tarball was downloaded 310 times; the SDK carries roughly 50,000 weekly downloads overall and has 87 direct dependents with a cumulative ~112,000 downloads, making the blast radius of any developer or CI pipeline that happened to `npm install` during that ~50-minute window nontrivial. Application security vendors Socket, Ox Security, and StepSecurity independently detected and disclosed the compromise. As of disclosure the deprecated v1.20.21 npm release (and its corresponding GitHub release artifacts) remained retrievable rather than fully removed, meaning cached copies, private registry mirrors, or lockfiles pinned to the exact version and integrity hash could still deliver the malicious code after the public window closed.

No CVE has been assigned. No public threat-actor attribution has been disclosed; the account-takeover vector (credential theft, session/token hijack, or social engineering of the maintainer) has not been confirmed by any source at time of writing.

MITRE ATT&CK techniques used in TL-2026-1153

Collection

T1005 Data from Local System; T1074.001 Local Data Staging; T1119 Automated Collection

Defense Evasion

T1027 Obfuscated Files or Information; T1027.010 Command Obfuscation; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1029 Scheduled Transfer; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Command and Control

T1071 Application Layer Protocol; T1071.001 Web Protocols; T1132.001 Standard Encoding

Initial Access

T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

initial-access

T1195.002 Compromise Software Supply Chain

Execution

T1204 User Execution; T1204.003 Malicious Image

Credential Access

T1528 Steal Application Access Token; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers

Persistence

T1554 Compromise Host Software Binary

Resource Development

T1583.006 Web Services; T1586 Compromise Accounts; T1587.001 Malware

Impact

T1657 Financial Theft

Affected products and versions in npm Supply Chain Attack

  • InjectiveLabs — @injectivelabs/sdk-ts
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/networks
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/utils
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/exceptions
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/ts-types
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/wallet-base
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/wallet-core
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/wallet-strategy
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/wallet-cosmos
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23
  • InjectiveLabs — @injectivelabs/wallet-cosmos-strategy
    Vulnerable versions: 1.20.21
    Fixed in: 1.20.23

Remediation for npm Supply Chain Attack

Patches

  • @injectivelabs/sdk-ts and all 17 sibling packages patched in v1.20.23 (2026-07-08 21:47-21:49 UTC)

Immediate actions

  • Upgrade every affected @injectivelabs package to v1.20.23 or later immediately
  • Audit package.json and lockfiles across all repos/CI pipelines for any pin to @injectivelabs/sdk-ts@1.20.21 or the 17 sibling packages at 1.20.21
  • Enable egress filtering / DNS sinkholing to block outbound connections to testnet.archival.chain.grpc-web.injective.network
  • Hunt network/proxy logs for POST requests to the exfiltration domain with an empty body and a populated X-Request-Id header and Content-Type: application/grpc-web+proto

Workarounds

  • Pin dependencies to a known-good version (<=1.20.20 or >=1.20.23) and lock via checksums/integrity hashes until provenance is re-verified
  • Clear npm cache and any internal/container registry mirrors that may have cached the malicious v1.20.21 tarball (SRI sha512-TMEWc0Hw2zA38HnCsLiZPWiwz4mRcDg94B5TDUAolQIXKsnY6xrE61iyffP0WuNZpQTrePCYZXuQFYaRQHFPPA==)

Longer-term hardening

  • Treat any mnemonic seed phrase or private key processed by an application using v1.20.21 as fully compromised — rotate/transfer all affected cryptocurrency wallets to new keys generated on a clean SDK version
  • Rotate all developer and CI/CD secrets that may have been present in the same runtime environment as the compromised SDK during the exposure window
  • Enforce mandatory branch protection (required reviews, no direct push to master) on all InjectiveLabs monorepo branches to prevent single-account takeover from reaching production releases
  • Require MFA and hardware security keys for all npm-publishing and GitHub-maintainer accounts on the project
  • Adopt npm provenance/attestation and integrity-hash pinning verification in downstream CI to catch unexpected tarball hash changes on trusted-publish releases

Weaknesses (CWE) in npm Supply Chain Attack

CWE-506, CWE-829, CWE-311, CWE-522

Timeline of npm Supply Chain Attack

  • Attacker gains control of trusted GitHub maintainer account thomasRalee and makes initial suspicious commits to the InjectiveLabs/injective-ts repository (per BleepingComputer reporting).
  • Clean version v1.20.23 published across all 18 packages between 21:47-21:49 UTC; v1.20.21 marked deprecated on npm. Total malicious exposure window approximately 49-50 minutes; malicious tarball downloaded 310 times.
  • Revert commit 7c4b1a092d8cbbcda469bda5a88db2a742d15b4a authored by the same thomasRalee account removes the exfiltration code at 21:16 UTC (05:16 Beijing time 2026-07-09).
  • Compromise detected within minutes of publication; independently identified and disclosed by application security firms Socket, Ox Security, and StepSecurity.
  • All 18 @injectivelabs packages published to npm at v1.20.21 between 20:59-21:00 UTC; wallet-stealing payload becomes live and downloadable.
  • Version bump commit 5486f13e799d9c90095c5f581a04ad867d768f66 at 20:54 UTC triggers the GitHub Actions OIDC trusted-publishing workflow, automatically releasing to npm without a separate publish token.
  • Cosmetic reformat commit fd105db073a21a3b58d5bd32622204ec8b57993 pushed at 20:48 UTC, likely to obscure the preceding malicious diff.
  • Malicious commit 01219285b16ce85c70cdf47a71a551ff5e41f1ed lands directly on master at 20:24 UTC, adding src/utils/key-derivation-telemetry.ts and wiring trackKeyDerivation() into PrivateKey.fromMnemonic() and PrivateKey.fromHex().
  • StepSecurity notes deprecated v1.20.21 npm release and corresponding GitHub release artifacts remain retrievable rather than fully removed, posing residual risk via caches, mirrors, and pinned lockfiles.
  • BleepingComputer publishes public reporting on the supply-chain attack, citing Socket, Ox Security, and StepSecurity analyses.

Sources cited for npm Supply Chain Attack

Threats related to npm Supply Chain Attack

Detection coverage for TL-2026-1153

As of 2026-07-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1153 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats