# Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry

> A compromised GitHub contributor account was used to push a backdoored release (1.20.21) of @injectivelabs/sdk-ts and 17 dependent @injectivelabs-scoped packages to npm. The malicious code hooked PrivateKey.fromMnemonic() and PrivateKey.fromHex(), disguised as anonymized telemetry, to capture wallet mnemonics and private keys, base64-encode them, and smuggle them inside the X-Request-Id header of HTTPS POST requests to a spoofed Injective testnet archival endpoint. The malicious version was live on npm for roughly 49 minutes and downloaded 310 times before the maintainer reverted the code and published clean version 1.20.23.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-10-28T08:06:51.990Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1381
- **ID:** TL-2026-1381
- **Severity:** HIGH (CVSS 7.8)
- **Category:** SUPPLY_CHAIN
- **Status:** RESOLVED
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 8, 2026, an attacker gained control of a GitHub account belonging to a longtime, trusted contributor to the Injective Labs SDK repository and used it to push commits to a branch named test-backdoor-check at 20:24:40 UTC. The commits introduced a function named trackKeyDerivation(method, value), documented in code comments as recording only 'anonymized usage metrics' and 'timing patterns for usage analytics' for SDK optimization, but which in fact captured the full argument passed into two critical key-derivation entry points: PrivateKey.fromMnemonic() (BIP-39 12-24 word recovery phrases) and PrivateKey.fromHex() (raw hex-encoded private keys). Two follow-up commits (fd105db, 5486f13) applied cosmetic formatting changes, likely to reduce the visual footprint of the diff for reviewers. At 20:59:28 UTC the attacker published the poisoned code as @injectivelabs/sdk-ts@1.20.21 to the public npm registry, and in the same window re-published version 1.20.21 across 17 additional packages in the @injectivelabs npm scope (utils, networks, ts-types, exceptions, wallet-base, wallet-core, wallet-cosmos, wallet-private-key, wallet-evm, wallet-trezor, wallet-cosmostation, wallet-ledger, wallet-wallet-connect, wallet-magic, wallet-strategy, wallet-turnkey, wallet-cosmos-strategy), each pinned to the malicious SDK version so that any application depending on the wallet helper packages would transitively pull in the stealer even without directly depending on sdk-ts.

The stealer avoided execution at install time (no postinstall/preinstall hook), instead activating only when a downstream application actually called the wallet key-derivation functions during normal runtime use — a design choice intended to evade both static/install-time scanners and superficial code review, since the malicious code path only fires under real usage. Captured mnemonic or private-key material was base64-encoded and batched over a 2-second window before being smuggled inside the X-Request-Id HTTP header of an HTTPS POST request with Content-Type application/grpc-web+proto, sent to testnet.archival.chain.grpc-web.injective.network — a domain crafted to closely resemble legitimate Injective testnet archival gRPC-Web infrastructure so exfiltration traffic would blend into expected application telemetry and evade network egress monitoring. The endpoint string itself was constructed at runtime from character-code arrays rather than a literal, a lightweight obfuscation technique aimed at defeating static string-matching detections.

The legitimate account owner/maintainer detected the anomaly quickly: a revert commit (7c4b1a0) landed at 21:16:32 UTC, and a clean release, version 1.20.23, was published at 21:48:03 UTC — roughly 49 minutes after the malicious version first went live. Public disclosure followed via a GitHub issue (#697) at 22:07:59 UTC the same day. Socket, Aikido, Datadog Security Labs, Ox Security and StepSecurity independently detected and analyzed the incident. npm registry statistics show the malicious 1.20.21 release was downloaded approximately 310 times in its brief window of availability; the package normally sees roughly 50,000 weekly (and ~175,000 monthly) downloads, reflecting its use as a widely depended-on SDK for building wallets, trading bots, DEX front-ends, DeFi applications and payment tooling on the Injective blockchain. The deprecated malicious release and its associated GitHub commit/release artifacts reportedly remained retrievable after disclosure rather than being fully purged, extending the residual exposure window for anyone who cached or mirrored the tarball. Attribution indicators noted by responders include commits originating from a UTC-4 timezone never previously associated with the compromised account, and direct pushes to the default/release branch bypassing the project's normal pull-request review workflow — both consistent with account takeover (credential theft, token compromise, or session hijack) rather than an insider or a compromised build pipeline. No public attribution to a specific named threat actor or group has been established; no CVE or GHSA identifier had been assigned as of the source reporting.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1586 Compromise Accounts
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1204 User Execution
- T1505 Server Software Component
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1001 Data Obfuscation
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1657 Financial Theft
- T1195.002 Supply Chain Compromise
- T1078 Valid Accounts
- T1059.007 Command and Scripting Interpreter
- T1071.001 Application Layer Protocol
- T1132.001 Data Encoding

## Sources

- [Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys](https://threats.wiz.io/all-incidents/compromised-injective-sdk-npm-package-exfiltrates-cryptocurrency-wallet-keys)
- [Compromised Injective SDK npm Package Exfiltrates Wallet Keys](https://socket.dev/blog/compromised-injective-sdk-npm-package)
- [Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor](https://securitylabs.datadoghq.com/articles/not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor/)
- [Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages](https://thehackernews.com/2026/07/injective-labs-github-compromise-pushes.html)
- [Injective SDK on npm infected with cryptocurrency wallet stealer](https://www.bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer/)
- [Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry](https://www.aikido.dev/blog/compromised-injectivelabs-exfiltrates-keys)
- [Injective Labs SDK npm package compromised to steal cryptocurrency keys](https://www.scworld.com/brief/injective-labs-sdk-npm-package-compromised-to-steal-cryptocurrency-keys)
- [Injective npm Package Attack: 18 Packages Compromised, No Funds Lost](https://www.sourcetrail.com/javascript/npm/injective-npm-package-supply-chain-attack-what-developers-need-to-know/)
- [Injective NPM Package Hacked to Steal Crypto Wallet Keys](https://cointelegraph.com/news/hackers-compromise-injective-npm-package-with-malware-to-steal-wallet-keys)
- [Hackers attempt to backdoor Injective npm package to steal wallet keys](https://cryptobriefing.com/injective-npm-backdoor-wallet-key-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1381