Compromised Injective SDK npm Package (@injectivelabs/sdk-ts 1.20.21) Exfiltrates Cryptocurrency Wallet Keys

Key facts for Injective SDK npm compromise

Detection coverage for Injective SDK npm compromise

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5002 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5002 Wallet-Key Exfiltration Endpoint Lookups for Injective gRPC-web Lookalike Hosts (Splunk SPL)

Detects DNS lookups for testnet.archival.chain.grpc-web.injective.network (reported by Wiz, Socket and OffSeq) and hexhole.injective.network (GitHub issue #697, lower confidence). The compromised SDK builds the endpoint from char-code arrays to evade string scanning and POSTs Base64-encoded mnemonics and private keys over HTTPS, framed as Injective gRPC-web traffic. A lookup from a build host, CI runner or wallet-handling host indicates the stealer ran and keys may have left the environment.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1132.001, T1041, T1552, T1036
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, zeek, bro:dns:json, DeviceNetworkEvents
• Severity: critical
• Confidence: high

Splunk SPL

(index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 (QueryName="testnet.archival.chain.grpc-web.injective.network" OR QueryName="hexhole.injective.network")) OR (index=zeek sourcetype="bro:dns:json" (query="testnet.archival.chain.grpc-web.injective.network" OR query="hexhole.injective.network"))
```Sysmon EventCode 22 gives the querying process, Zeek gives the client IP for network-level coverage```
| eval queried_domain=coalesce(QueryName, query), client=coalesce(host, 'id.orig_h'), process=coalesce(Image, "n/a")
| stats count earliest(_time) AS first_seen latest(_time) AS last_seen values(process) AS processes by client, queried_domain
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any ("testnet.archival.chain.grpc-web.injective.network", "hexhole.injective.network")
| extend InitiatedByJsRuntime = InitiatingProcessFileName in~ ("node", "node.exe", "bun", "bun.exe", "deno", "deno.exe")
| project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, RemotePort, InitiatedByJsRuntime, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

Sigma

title: DNS Lookup for Injective Lookalike Wallet-Key Exfiltration Endpoint
id: c4e8f1a9-5d20-4b76-9e3c-1a7b6d0f2903
status: experimental
description: Detects DNS queries for testnet.archival.chain.grpc-web.injective.network and hexhole.injective.network, the endpoints used by the compromised @injectivelabs/sdk-ts 1.20.21 to exfiltrate Base64-encoded mnemonics and private keys (TL-2026-5002, MAL-2026-10165).
references:
    - https://socket.dev/blog/compromised-injective-sdk-npm-package
    - https://threats.wiz.io/all-incidents/compromised-injective-sdk-npm-package-exfiltrates-cryptocurrency-wallet-keys
    - https://github.com/InjectiveLabs/injective-ts/issues/697
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-01
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1132.001
    - attack.defense-evasion
    - attack.t1036
    - attack.exfiltration
    - attack.t1041
    - attack.credential-access
    - attack.t1552
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'testnet.archival.chain.grpc-web.injective.network'
            - 'hexhole.injective.network'
    condition: selection
falsepositives:
    - Threat-intelligence enrichment or sandbox tooling that resolves the indicator domains
    - Analysts manually testing the reported IOCs
level: critical

Known false positives:

• Threat-intelligence enrichment or sandbox tooling that resolves the indicator domains
• Analysts manually testing the reported IOCs

Tuning notes: hexhole.injective.network comes from a single source (GitHub issue #697) and is lower confidence, so consider a separate lower-severity alert for it. Real Injective gRPC-web hosts exist under injective.network, so match these two exact hostnames and do not wildcard the parent domain. Sibling infrastructure is not known: osint_context.json holds no community-corroborated indicators for this threat. Adapt the index and sourcetype names to your Sysmon and Zeek deployments, and add proxy or firewall logs for hosts without DNS telemetry. Prioritise alerts from CI runners and hosts that handle wallet keys.

• 🔒 TL-2026-5002 Compromised @injectivelabs npm Package 1.20.21 Installed or Resolved (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 TL-2026-5002 Injected Stealer Bundle accounts-jQ1GSgaW.js / accounts-Cy0p4lLW.cjs or Known Malicious Hash (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 TL-2026-5002 Wallet-Key Exfiltration Connections to Injective gRPC-web Lookalike Hosts (Microsoft Sentinel KQL) · unlock with TL Creds
• 🔒 TL-2026-5002 Compromised @injectivelabs npm Package 1.20.21 Installed or Resolved (Sigma) · unlock with TL Creds
• 🔒 TL-2026-5002 Injected Stealer Bundle accounts-jQ1GSgaW.js / accounts-Cy0p4lLW.cjs (Sigma) · unlock with TL Creds
• 🔒 TL-2026-5002 DNS Lookup for Injective Lookalike Wallet-Key Exfiltration Endpoint (Sigma) · unlock with TL Creds
• 🔒 TL-2026-5002 Compromised @injectivelabs npm Package 1.20.21 Installed or Resolved (Splunk SPL) · unlock with TL Creds
• 🔒 TL-2026-5002 Injected Stealer Bundle accounts-jQ1GSgaW.js / accounts-Cy0p4lLW.cjs or Known Malicious Hash (Splunk SPL) · unlock with TL Creds

Indicators of compromise for Injective SDK npm compromise

As of 2026-11-01, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5002.

Sample indicators (3 of 9)

• Domain: testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network
• File hash: 103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0
• Domain: hexhole[.]injective[.]network

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

How Injective SDK npm compromise works

On 2026-07-08 at 20:59:28 UTC, version 1.20.21 of the @injectivelabs/sdk-ts npm package was published after a legitimate contributor account with an established commit history was compromised. Per Socket, the same version number was also published for 17 other packages in the @injectivelabs scope whose dependencies were pinned to the malicious SDK, for 18 compromised packages in total. The initial-access method for the account takeover is not stated in any source reviewed. The previous release, 1.20.20, was published on 2026-07-07 and is clean.

The malicious code is a credential stealer disguised as 'key derivation telemetry'. It hooks PrivateKey.fromMnemonic(), which captures full mnemonic phrases, and PrivateKey.fromHex(), which captures raw private key strings. A function named trackKeyDerivation() records the derivation method and the key material. The code sits in the compiled bundles /dist/esm/accounts-jQ1GSgaW.js and /dist/cjs/accounts-Cy0p4lLW.cjs. The key material is Base64-encoded and sent by HTTPS POST to https://testnet.archival.chain.grpc-web.injective.network/. The endpoint URL is built from char-code arrays to hide it from string scanning, and the traffic is framed as legitimate Injective gRPC-web traffic. The payload runs at runtime when the wallet functions are called, not at install time, so install-script scanners would not flag it.

A clean release, 1.20.23, was published at 21:48:03 UTC the same day, about 49 minutes after the malicious release. Version 1.20.22 was never released. The affected versions were deprecated with a security warning, and the maintainer closed GitHub issue #697 on 2026-07-08. Socket reported about 310 downloads of the malicious version; the legitimate package averages about 50,000 weekly downloads. Injective's CEO publicly disputed the download count and said there were zero downloads of the malicious package. No confirmed theft of funds has been reported. Socket publicly disclosed the compromise on 2026-07-09. Socket, Ox Security and StepSecurity are reported to have detected it. OSV tracks it as MAL-2026-10165 and GitHub as GHSA-5fc4-fm2x-6f4r.

Source discrepancies: Socket's article and Cointelegraph give the start as June 8, 2026, but the npm publish metadata cited by OffSeq and the GitHub issue timeline both give 2026-07-08, so this record uses July 8 (Socket's '22:59 GMT+2' equals 20:59 UTC). The GitHub issue describes the exfiltration target as https://hexhole.injective.network/ with the Base64 payload in an X-Request-Id header. Wiz, Socket and OffSeq instead report testnet.archival.chain.grpc-web.injective.network. Both are listed as IOCs, and the hexhole details are unconfirmed by other sources. Anyone who called PrivateKey.fromMnemonic or fromHex under 1.20.21 should treat those mnemonics and keys as compromised and move funds to newly generated wallets.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1132.001 Standard Encoding

Initial Access

T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools

Credential Access

T1552 Unsecured Credentials

Remediation for Injective SDK npm compromise

Patches

• Upgrade @injectivelabs/sdk-ts to 1.20.23 or later (1.20.22 was never released)

Immediate actions

• Identify any project, lockfile, container image or CI cache that resolved @injectivelabs/sdk-ts 1.20.21 or any other @injectivelabs package at 1.20.21, and remove it
• Treat every mnemonic and private key passed to PrivateKey.fromMnemonic or PrivateKey.fromHex under 1.20.21 as compromised, and move funds to newly generated wallets
• Block and alert on egress to testnet.archival.chain.grpc-web.injective.network and hexhole.injective.network from build systems and runtime hosts
• Rotate other credentials from clean machines, as advised by OffSeq

Workarounds

• Pin @injectivelabs/sdk-ts to 1.20.20 until the upgrade to 1.20.23 or later is validated

Longer-term hardening

• Pin dependencies with lockfiles and integrity hashes, and delay adoption of freshly published versions
• Run package-behavior scanning in CI to catch runtime network calls added to key-handling code
• Enforce MFA and trusted-publishing provenance for npm publish rights
• Do not handle production wallet keys in environments that load unvetted dependencies

Affected and fixed versions

• Injective Labs — @injectivelabs/sdk-ts (npm)
  Vulnerable versions: 1.20.21
  Fixed in: 1.20.23
• Injective Labs — 17 other @injectivelabs-scoped npm packages that pinned @injectivelabs/sdk-ts 1.20.21
  Vulnerable versions: 1.20.21
  Fixed in: 1.20.23 or later clean releases

Timeline of Injective SDK npm compromise

• 2026-07-07 locked-ioc-9 1.20.20 published at 14:29:31 UTC; the last clean release before the compromise (GitHub issue #697).
• 2026-07-08 1.20.23 published at 21:48:03 UTC, about 49 minutes later, with the malicious code removed. Versions deprecated with a security warning and GitHub issue #697 closed.
• 2026-07-08 1.20.21 of locked-ioc-9 published at 20:59:28 UTC from a compromised contributor account. The same version was published for 17 other @injectivelabs packages pinned to it. Socket's text says June 8; npm metadata and the GitHub issue say July 8.
• 2026-07-09 Socket published its analysis of the compromised package; Wiz Threat Center listed the incident the same day.
• 2026-07-10 Cointelegraph reported the incident. Injective's CEO said the issue was fixed and disputed Socket's count of 310 downloads. OSV MAL-2026-10165 and GHSA-5fc4-fm2x-6f4r were published around this date.
• 2026-07-15 Wiz Threat Center record last updated.

Sources cited for Injective SDK npm compromise

• OSV MAL-2026-10165 osv.dev · Advisory · 2026-07-10
• GitHub Advisory GHSA-5fc4-fm2x-6f4r GitHub · Advisory · 2026-07-10
• Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys (Wiz Threat Center) Wiz · Research · 2026-07-09
• Malicious code in @injectivelabs/sdk-ts (npm) (OffSeq Threat Radar) radar.offseq.com · Research · 2026-07-10
• InjectiveLabs/injective-ts issue #697 GitHub · Code repository · 2026-07-08
• Compromised Injective SDK npm Package (Socket) socket.dev · Blog · 2026-07-09
• Hackers compromise Injective npm package with malware to steal wallet keys (Cointelegraph) cointelegraph.com · News · 2026-07-10

More in supply chain

• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)
• Haiou Jailbreak Bundle: 'Prompt Adware' Persistently Altering AI Coding Agent Instructions to Promote LLM Gateway (zz.aiapi2025.top)
• XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google
• Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages