Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry
Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) (TL-2026-1381), also tracked as Injective SDK npm Backdoor, is a high-severity supply-chain compromise scored CVSS 7.8, first published 2026-07-15. It has no confirmed attribution, affects Injective Labs @injectivelabs/sdk-ts, maps to 20 MITRE ATT&CK techniques (T1001, T1005, T1020), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1381
- Threat ID
- TL-2026-1381
- Also known as
- Injective SDK npm Backdoor, injectivelabs/sdk-ts Supply Chain Attack
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
- Status
- RESOLVED
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-15
- Last reviewed
- 2026-07-15
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, blockchaininfrastructure, softwaredevelopment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
A compromised GitHub contributor account was used to push a backdoored release (1.20.21) of @injectivelabs/sdk-ts and 17 dependent @injectivelabs-scoped packages to npm. The malicious code hooked PrivateKey.fromMnemonic() and PrivateKey.fromHex(), disguised as anonymized telemetry, to capture wallet mnemonics and private keys, base64-encode them, and smuggle them inside the X-Request-Id header of HTTPS POST requests to a spoofed Injective testnet archival endpoint. The malicious version was live on npm for roughly 49 minutes and downloaded 310 times before the maintainer reverted the code and published clean version 1.20.23.
How Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) works
On June 8, 2026, an attacker gained control of a GitHub account belonging to a longtime, trusted contributor to the Injective Labs SDK repository and used it to push commits to a branch named test-backdoor-check at 20:24:40 UTC. The commits introduced a function named trackKeyDerivation(method, value), documented in code comments as recording only 'anonymized usage metrics' and 'timing patterns for usage analytics' for SDK optimization, but which in fact captured the full argument passed into two critical key-derivation entry points: PrivateKey.fromMnemonic() (BIP-39 12-24 word recovery phrases) and PrivateKey.fromHex() (raw hex-encoded private keys). Two follow-up commits (fd105db, 5486f13) applied cosmetic formatting changes, likely to reduce the visual footprint of the diff for reviewers. At 20:59:28 UTC the attacker published the poisoned code as @injectivelabs/sdk-ts@1.20.21 to the public npm registry, and in the same window re-published version 1.20.21 across 17 additional packages in the @injectivelabs npm scope (utils, networks, ts-types, exceptions, wallet-base, wallet-core, wallet-cosmos, wallet-private-key, wallet-evm, wallet-trezor, wallet-cosmostation, wallet-ledger, wallet-wallet-connect, wallet-magic, wallet-strategy, wallet-turnkey, wallet-cosmos-strategy), each pinned to the malicious SDK version so that any application depending on the wallet helper packages would transitively pull in the stealer even without directly depending on sdk-ts.
The stealer avoided execution at install time (no postinstall/preinstall hook), instead activating only when a downstream application actually called the wallet key-derivation functions during normal runtime use — a design choice intended to evade both static/install-time scanners and superficial code review, since the malicious code path only fires under real usage. Captured mnemonic or private-key material was base64-encoded and batched over a 2-second window before being smuggled inside the X-Request-Id HTTP header of an HTTPS POST request with Content-Type application/grpc-web+proto, sent to testnet.archival.chain.grpc-web.injective.network — a domain crafted to closely resemble legitimate Injective testnet archival gRPC-Web infrastructure so exfiltration traffic would blend into expected application telemetry and evade network egress monitoring. The endpoint string itself was constructed at runtime from character-code arrays rather than a literal, a lightweight obfuscation technique aimed at defeating static string-matching detections.
The legitimate account owner/maintainer detected the anomaly quickly: a revert commit (7c4b1a0) landed at 21:16:32 UTC, and a clean release, version 1.20.23, was published at 21:48:03 UTC — roughly 49 minutes after the malicious version first went live. Public disclosure followed via a GitHub issue (#697) at 22:07:59 UTC the same day. Socket, Aikido, Datadog Security Labs, Ox Security and StepSecurity independently detected and analyzed the incident. npm registry statistics show the malicious 1.20.21 release was downloaded approximately 310 times in its brief window of availability; the package normally sees roughly 50,000 weekly (and ~175,000 monthly) downloads, reflecting its use as a widely depended-on SDK for building wallets, trading bots, DEX front-ends, DeFi applications and payment tooling on the Injective blockchain. The deprecated malicious release and its associated GitHub commit/release artifacts reportedly remained retrievable after disclosure rather than being fully purged, extending the residual exposure window for anyone who cached or mirrored the tarball. Attribution indicators noted by responders include commits originating from a UTC-4 timezone never previously associated with the compromised account, and direct pushes to the default/release branch bypassing the project's normal pull-request review workflow — both consistent with account takeover (credential theft, token compromise, or session hijack) rather than an insider or a compromised build pipeline. No public attribution to a specific named threat actor or group has been established; no CVE or GHSA identifier had been assigned as of the source reporting.
MITRE ATT&CK techniques used in TL-2026-1381
Command and Control
T1001 Data Obfuscation; T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol
Collection
T1005 Data from Local System; T1119 Automated Collection
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Execution
Persistence
T1505 Server Software Component
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities
Impact
Affected products and versions in Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
- Injective Labs — @injectivelabs/sdk-ts
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 - Injective Labs — @injectivelabs/utils
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later, or unpin from malicious version - Injective Labs — @injectivelabs/networks
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/ts-types
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/exceptions
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-base
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-core
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-cosmos
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-private-key
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-evm
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later
Remediation for Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
Patches
- @injectivelabs/sdk-ts upgraded to 1.20.23 (clean release)
- All 17 dependent @injectivelabs packages republished at non-malicious versions after the incident
Immediate actions
- Audit package.json / lockfiles across all repos for any @injectivelabs-scoped dependency pinned to or resolving to version 1.20.21
- Upgrade @injectivelabs/sdk-ts and all 17 affected @injectivelabs wallet/support packages to clean version 1.20.23 or later
- Treat every mnemonic phrase and private key that was ever passed through PrivateKey.fromMnemonic() or PrivateKey.fromHex() while running 1.20.21 as fully compromised
- Immediately rotate/regenerate and transfer funds away from any wallet whose key material may have passed through the affected code path
- Block/alert on outbound traffic to testnet.archival.chain.grpc-web.injective.network and inspect X-Request-Id header values in outbound HTTPS logs for base64-encoded payloads
Workarounds
- Pin @injectivelabs packages to a known-good version prior to 1.20.21 until 1.20.23+ is verified in your environment
- Run applications using the SDK in network-egress-restricted environments that only allowlist known Injective mainnet/testnet endpoints
Longer-term hardening
- Enforce npm package pinning with lockfile integrity checks (npm ci) and exact-version pins rather than caret/tilde ranges for security-sensitive crypto/wallet SDKs
- Adopt Sigstore/npm provenance attestation verification and SLSA-aware CI gates for third-party dependency updates
- Require MFA and hardware security keys on all npm publish and GitHub maintainer accounts for security-sensitive projects
- Add automated Software Composition Analysis (SCA) / behavioral scanning (e.g. Socket, Aikido) to CI pipelines to flag runtime network calls introduced in dependency diffs
- Establish branch protection requiring PR review + status checks on default/release branches to prevent direct pushes of publishable code
Weaknesses (CWE) in Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
CWE-506, CWE-912, CWE-311, CWE-200
Timeline of Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
- Incident is publicly disclosed via GitHub issue #697 at 22:07:59 UTC.
- Clean version 1.20.23 of @injectivelabs/sdk-ts is published to npm at 21:48:03 UTC, superseding the malicious release.
- Legitimate maintainer/account owner submits a revert commit (7c4b1a0) at 21:16:32 UTC removing the malicious trackKeyDerivation hooks.
- Malicious version 1.20.21 remains live and downloadable on npm for approximately 49 minutes, accumulating roughly 310 downloads before remediation.
- Backdoored @injectivelabs/sdk-ts version 1.20.21 is published to the public npm registry at 20:59:28 UTC; the same version number is simultaneously republished across 17 dependent @injectivelabs-scoped packages, each pinned to the malicious SDK.
- Two additional formatting/cosmetic commits (fd105db at 20:48:14 UTC, 5486f13 at 20:54:02 UTC) are pushed, likely to minimize the visible diff footprint of the injected trackKeyDerivation() code for reviewers.
- Attacker uses a compromised GitHub account belonging to a trusted, longtime Injective SDK contributor to push suspicious commits to a branch named test-backdoor-check at 20:24:40 UTC (commit 0121928), bypassing the project's normal pull-request review workflow via direct push.
- Wiz, Socket, Aikido, and other security vendors publish independent incident write-ups and technical analyses of the supply-chain attack.
- Datadog Security Labs publishes an in-depth technical breakdown ('Not-so-anonymous telemetry') including full timeline, IOC hashes, MITRE ATT&CK mapping, and detection queries.
- Incident status finalized as resolved; malicious package artifacts reportedly remain retrievable via GitHub/npm cache despite deprecation, extending residual exposure for late consumers.
Sources cited for Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
- Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys
- Compromised Injective SDK npm Package Exfiltrates Wallet Keys
- Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor
- Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
- Injective SDK on npm infected with cryptocurrency wallet stealer
- Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry
- Injective Labs SDK npm package compromised to steal cryptocurrency keys
- Injective npm Package Attack: 18 Packages Compromised, No Funds Lost
- Injective NPM Package Hacked to Steal Crypto Wallet Keys
- Hackers attempt to backdoor Injective npm package to steal wallet keys
Threats related to Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
- npm Supply Chain Attack: @injectivelabs/sdk-ts v1.20.21 and 17 Sibling Packages Infected with Cryptocurrency Wallet Stealer
- npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 Exfiltrates Crypto Wallet Seed Phrases and Private Keys
- Trojanized NuGet Typosquat "Newtonsoftt.Json.Net" Rigs Digitain FG-Crash Betting Platform, Exfiltrates Results via C2
- Indirect Setup-Error Prompt Abuse: Clean GitHub Repo + Failing Python Package + DNS TXT Payload Tricks AI Coding Agents (Claude Code) into Running a Reverse Shell
Detection coverage for TL-2026-1381
As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1381 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.