Threat reportSupply ChainTL-2026-1381
Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry
Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) (TL-2026-1381), also tracked as Injective SDK npm Backdoor, is a high-severity supply-chain compromise scored CVSS 7.8, first published 2026-07-15 and last reviewed 2026-10-28. It has no confirmed attribution, affects Injective Labs @injectivelabs/sdk-ts, maps to 25 MITRE ATT&CK techniques (T1001, T1005, T1020), and is covered by 9 detection rules and 37 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-1381
- Threat ID
- TL-2026-1381
- Also known as
- Injective SDK npm Backdoor, injectivelabs/sdk-ts Supply Chain Attack
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
- Status
- RESOLVED
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, blockchaininfrastructure, softwaredevelopment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 37
- Updates
- 2026-10-28 · revalidated 1× · latest source
How Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) works
A compromised GitHub contributor account was used to push a backdoored release (1.20.21) of @injectivelabs/sdk-ts and 17 dependent @injectivelabs-scoped packages to npm. The malicious code hooked PrivateKey.fromMnemonic() and PrivateKey.fromHex(), disguised as anonymized telemetry, to capture wallet mnemonics and private keys, base64-encode them, and smuggle them inside the X-Request-Id header of HTTPS POST requests to a spoofed Injective testnet archival endpoint. The malicious version was live on npm for roughly 49 minutes and downloaded 310 times before the maintainer reverted the code and published clean version 1.20.23.
On June 8, 2026, an attacker gained control of a GitHub account belonging to a longtime, trusted contributor to the Injective Labs SDK repository and used it to push commits to a branch named test-backdoor-check at 20:24:40 UTC. The commits introduced a function named trackKeyDerivation(method, value), documented in code comments as recording only 'anonymized usage metrics' and 'timing patterns for usage analytics' for SDK optimization, but which in fact captured the full argument passed into two critical key-derivation entry points: PrivateKey.fromMnemonic() (BIP-39 12-24 word recovery phrases) and PrivateKey.fromHex() (raw hex-encoded private keys). Two follow-up commits (fd105db, 5486f13) applied cosmetic formatting changes, likely to reduce the visual footprint of the diff for reviewers. At 20:59:28 UTC the attacker published the poisoned code as @injectivelabs/sdk-ts@1.20.21 to the public npm registry, and in the same window re-published version 1.20.21 across 17 additional packages in the @injectivelabs npm scope (utils, networks, ts-types, exceptions, wallet-base, wallet-core, wallet-cosmos, wallet-private-key, wallet-evm, wallet-trezor, wallet-cosmostation, wallet-ledger, wallet-wallet-connect, wallet-magic, wallet-strategy, wallet-turnkey, wallet-cosmos-strategy), each pinned to the malicious SDK version so that any application depending on the wallet helper packages would transitively pull in the stealer even without directly depending on sdk-ts.
The stealer avoided execution at install time (no postinstall/preinstall hook), instead activating only when a downstream application actually called the wallet key-derivation functions during normal runtime use — a design choice intended to evade both static/install-time scanners and superficial code review, since the malicious code path only fires under real usage. Captured mnemonic or private-key material was base64-encoded and batched over a 2-second window before being smuggled inside the X-Request-Id HTTP header of an HTTPS POST request with Content-Type application/grpc-web+proto, sent to testnet.archival.chain.grpc-web.injective.network — a domain crafted to closely resemble legitimate Injective testnet archival gRPC-Web infrastructure so exfiltration traffic would blend into expected application telemetry and evade network egress monitoring. The endpoint string itself was constructed at runtime from character-code arrays rather than a literal, a lightweight obfuscation technique aimed at defeating static string-matching detections.
The legitimate account owner/maintainer detected the anomaly quickly: a revert commit (7c4b1a0) landed at 21:16:32 UTC, and a clean release, version 1.20.23, was published at 21:48:03 UTC — roughly 49 minutes after the malicious version first went live. Public disclosure followed via a GitHub issue (#697) at 22:07:59 UTC the same day. Socket, Aikido, Datadog Security Labs, Ox Security and StepSecurity independently detected and analyzed the incident. npm registry statistics show the malicious 1.20.21 release was downloaded approximately 310 times in its brief window of availability; the package normally sees roughly 50,000 weekly (and ~175,000 monthly) downloads, reflecting its use as a widely depended-on SDK for building wallets, trading bots, DEX front-ends, DeFi applications and payment tooling on the Injective blockchain. The deprecated malicious release and its associated GitHub commit/release artifacts reportedly remained retrievable after disclosure rather than being fully purged, extending the residual exposure window for anyone who cached or mirrored the tarball. Attribution indicators noted by responders include commits originating from a UTC-4 timezone never previously associated with the compromised account, and direct pushes to the default/release branch bypassing the project's normal pull-request review workflow — both consistent with account takeover (credential theft, token compromise, or session hijack) rather than an insider or a compromised build pipeline. No public attribution to a specific named threat actor or group has been established; no CVE or GHSA identifier had been assigned as of the source reporting.
MITRE ATT&CK techniques used in TL-2026-1381
Command and Control
T1001 Data Obfuscation; T1071 Application Layer Protocol; T1071.001 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1132.001 Data Encoding
Collection
T1005 Data from Local System; T1119 Automated Collection
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
Execution
T1059.007 Command and Scripting Interpreter; T1204 User Execution
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1195.002 Supply Chain Compromise; T1199 Trusted Relationship
Persistence
T1505 Server Software Component
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities
Impact
Affected products and versions in Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
- Injective Labs — @injectivelabs/sdk-ts
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 - Injective Labs — @injectivelabs/utils
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later, or unpin from malicious version - Injective Labs — @injectivelabs/networks
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/ts-types
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/exceptions
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-base
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-core
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-cosmos
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-private-key
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later - Injective Labs — @injectivelabs/wallet-evm
Vulnerable versions: 1.20.21
Fixed in: 1.20.23 or later
Remediation for Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
Patches
- @injectivelabs/sdk-ts upgraded to 1.20.23 (clean release)
- All 17 dependent @injectivelabs packages republished at non-malicious versions after the incident
Immediate actions
- Audit package.json / lockfiles across all repos for any @injectivelabs-scoped dependency pinned to or resolving to version 1.20.21
- Upgrade @injectivelabs/sdk-ts and all 17 affected @injectivelabs wallet/support packages to clean version 1.20.23 or later
- Treat every mnemonic phrase and private key that was ever passed through PrivateKey.fromMnemonic() or PrivateKey.fromHex() while running 1.20.21 as fully compromised
- Immediately rotate/regenerate and transfer funds away from any wallet whose key material may have passed through the affected code path
- Block/alert on outbound traffic to testnet.archival.chain.grpc-web.injective.network and inspect X-Request-Id header values in outbound HTTPS logs for base64-encoded payloads
Workarounds
- Pin @injectivelabs packages to a known-good version prior to 1.20.21 until 1.20.23+ is verified in your environment
- Run applications using the SDK in network-egress-restricted environments that only allowlist known Injective mainnet/testnet endpoints
Longer-term hardening
- Enforce npm package pinning with lockfile integrity checks (npm ci) and exact-version pins rather than caret/tilde ranges for security-sensitive crypto/wallet SDKs
- Adopt Sigstore/npm provenance attestation verification and SLSA-aware CI gates for third-party dependency updates
- Require MFA and hardware security keys on all npm publish and GitHub maintainer accounts for security-sensitive projects
- Add automated Software Composition Analysis (SCA) / behavioral scanning (e.g. Socket, Aikido) to CI pipelines to flag runtime network calls introduced in dependency diffs
- Establish branch protection requiring PR review + status checks on default/release branches to prevent direct pushes of publishable code
Weaknesses (CWE) in Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
Timeline of Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
- Incident is publicly disclosed via GitHub issue #697 at 22:07:59 UTC.
- Clean version 1.20.23 of @injectivelabs/sdk-ts is published to npm at 21:48:03 UTC, superseding the malicious release.
- Legitimate maintainer/account owner submits a revert commit (7c4b1a0) at 21:16:32 UTC removing the malicious trackKeyDerivation hooks.
- Malicious version 1.20.21 remains live and downloadable on npm for approximately 49 minutes, accumulating roughly 310 downloads before remediation.
- Backdoored @injectivelabs/sdk-ts version 1.20.21 is published to the public npm registry at 20:59:28 UTC; the same version number is simultaneously republished across 17 dependent @injectivelabs-scoped packages, each pinned to the malicious SDK.
- Two additional formatting/cosmetic commits (fd105db at 20:48:14 UTC, 5486f13 at 20:54:02 UTC) are pushed, likely to minimize the visible diff footprint of the injected trackKeyDerivation() code for reviewers.
- Attacker uses a compromised GitHub account belonging to a trusted, longtime Injective SDK contributor to push suspicious commits to a branch named test-backdoor-check at 20:24:40 UTC (commit 0121928), bypassing the project's normal pull-request review workflow via direct push.
- Datadog Security Labs reports the exfiltration endpoint was still alive and accepting requests at the time of writing; 1.20.21 was deprecated with a security warning but not unpublished.
- Wiz, Socket, Aikido, and other security vendors publish independent incident write-ups and technical analyses of the supply-chain attack.
- Datadog Security Labs publishes an in-depth technical breakdown ('Not-so-anonymous telemetry') including full timeline, IOC hashes, MITRE ATT&CK mapping, and detection queries.
- Incident status finalized as resolved; malicious package artifacts reportedly remain retrievable via GitHub/npm cache despite deprecation, extending residual exposure for late consumers.
Update history for TL-2026-1381
- 2026-10-28 — Backdoored @injectivelabs/sdk-ts 1.20.21 npm package (and 17 dependent @injectivelabs packages) exfiltrates wallet seed phrases and private keys: What changed Exploitability NONE → ACTIVE: the exfiltration endpoint was reported still live and the malicious 1.20.21 remains installable (deprecated, not unpublished). Severity and status left unchanged: the report's CRITICAL severity is
Sources cited for Compromised @injectivelabs/sdk-ts npm Package (v1.20.21)
- Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys
- Compromised Injective SDK npm Package Exfiltrates Wallet Keys
- Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor
- Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
- Injective SDK on npm infected with cryptocurrency wallet stealer
- Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry
- Injective Labs SDK npm package compromised to steal cryptocurrency keys
- Injective npm Package Attack: 18 Packages Compromised, No Funds Lost
- Injective NPM Package Hacked to Steal Crypto Wallet Keys
- Hackers attempt to backdoor Injective npm package to steal wallet keys
Detection coverage for TL-2026-1381
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1381 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.