Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry — Threadlinqs Intelligence
As of 2026-07-15, Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1381 · Severity: HIGH · CVSS: 7.8 · Status: RESOLVED · Category: SUPPLY_CHAIN
A compromised GitHub contributor account was used to push a backdoored release (1.20.21) of @injectivelabs/sdk-ts and 17 dependent @injectivelabs-scoped packages to npm. The malicious code hooked
On June 8, 2026, an attacker gained control of a GitHub account belonging to a longtime, trusted contributor to the Injective Labs SDK repository and used it to push commits to a branch named test-backdoor-check at 20:24:40 UTC. The commits introduced a function named trackKeyDerivation(method, value), documented in code comments as recording only 'anonymized usage metrics' and 'timing patterns for usage analytics' for SDK optimization, but which in fact captured the full argument passed into two critical key-derivation entry points: PrivateKey.fromMnemonic() (BIP-39 12-24 word recovery phrases) and PrivateKey.fromHex() (raw hex-encoded private keys). Two follow-up commits (fd105db, 5486f13) applied cosmetic formatting changes, likely to reduce the visual footprint of the diff for reviewers. At 20:59:28 UTC the attacker published the poisoned code as @injectivelabs/sdk-ts@1.20.21 to the public npm registry, and in the same window re-published version 1.20.21 across 17 additional packages in the @injectivelabs npm scope (utils, networks, ts-types, exceptions, wallet-base, wallet-core, wallet-cosmos, wallet-private-key, wallet-evm, wallet-trezor, wallet-cosmostation, wallet-ledger, wallet-wallet-connect, wallet-magic, wallet-strategy, wallet-turnkey, wallet-cosmos-strategy), each pinned to the malicious SDK version so that any application depending on the wallet helper packages would transitively pull in the stealer even without directly depending on sdk-ts.
The stealer avoided execution at install time (no postinstall/preinstall hook), instead activating only when a downstream application actually called the wallet key-derivation functions during normal runtime use — a design choice intended to evade both static/install-time scanners and superficial code review, since the malicious code path only fires under real usage. Captured mnemonic or private-key material was base64-encoded and batched over a 2-second window before being smuggled inside the X-Request-Id HTTP header of an HTTPS POST request with Content-Type application/grpc-web+proto, sent to testnet.archival.chain.grpc-web.injective.network — a domain crafted to closely resemble legitimate Injective testnet archival gRPC-Web infrastructure so exfiltration traffic would blend into expected application telemetry and evade network egress monitoring. The endpoint string itself was constructed at runtime from character-code arrays rather than a literal, a lightweight obfuscation technique aimed at defeating static string-matching detections.
The legitimate account owner/maintainer detected the anomaly quickly: a revert commit (7c4b1a0) landed at 21:16:32 UTC, and a clean release, version 1.20.23, was published at 21:48:03 UTC — roughly 49 minutes after the malicious version first went live. Public disclosure followed via a GitHub issue (#697) at 22:07:59 UTC the same day. Socket, Aikido, Datadog Security Labs, Ox Security and StepSecurity independently detected and analyzed the incident. npm registry statistics show the malicious 1.20.21 release was downloaded approximately 310 times in its brief window of availability; the package normally sees roughly 50,000 weekly (and ~175,000 monthly) downloads, reflecting its use as a widely depended-on SDK for building wallets, trading bots, DEX front-ends, DeFi applications and payment tooling on the Injective blockchain. The deprecated malicious release and its associated GitHub commit/release artifacts reportedly remained retrievable after disclosure rather than being fully purged, extending the residual exposure window for anyone who cached or mirrored the tarball. Attribution indicators noted by responders include commits originating from a UTC-4 timezone never previously associated with the compromised account, and direct pushes to the default/release branch bypassing the project's normal pull-request review workflow — both consistent with account takeover (credential theft, token compromise, or session hijack) rather than an i
Weaknesses (CWE)
CWE-506, CWE-912, CWE-311, CWE-200
Target sectors: cryptocurrency, finance, blockchaininfrastructure, softwaredevelopment
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1199, T1195, T1586, T1583, T1587, T1204, T1505, T1036, T1027, T1070