# Compromised Injective SDK npm Package (@injectivelabs/sdk-ts 1.20.21) Exfiltrates Cryptocurrency Wallet Keys

> A contributor account compromise let an unknown actor publish @injectivelabs/sdk-ts 1.20.21 to npm. The release hooked the PrivateKey.fromMnemonic and PrivateKey.fromHex wallet functions and exfiltrated mnemonics and private keys, Base64-encoded, over HTTPS to an Injective-lookalike endpoint. 17 other @injectivelabs packages at 1.20.21 pinned the malicious SDK.

- **Published:** 2026-11-01T15:14:04Z
- **Last reviewed:** 2026-11-01T15:14:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5002
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5002.png
- **ID:** TL-2026-5002
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** RESOLVED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (3 shown free below)

## Description

On 2026-07-08 at 20:59:28 UTC, version 1.20.21 of the @injectivelabs/sdk-ts npm package was published after a legitimate contributor account with an established commit history was compromised. Per Socket, the same version number was also published for 17 other packages in the @injectivelabs scope whose dependencies were pinned to the malicious SDK, for 18 compromised packages in total. The initial-access method for the account takeover is not stated in any source reviewed. The previous release, 1.20.20, was published on 2026-07-07 and is clean.

The malicious code is a credential stealer disguised as 'key derivation telemetry'. It hooks PrivateKey.fromMnemonic(), which captures full mnemonic phrases, and PrivateKey.fromHex(), which captures raw private key strings. A function named trackKeyDerivation() records the derivation method and the key material. The code sits in the compiled bundles /dist/esm/accounts-jQ1GSgaW.js and /dist/cjs/accounts-Cy0p4lLW.cjs. The key material is Base64-encoded and sent by HTTPS POST to https://testnet.archival.chain.grpc-web.injective.network/. The endpoint URL is built from char-code arrays to hide it from string scanning, and the traffic is framed as legitimate Injective gRPC-web traffic. The payload runs at runtime when the wallet functions are called, not at install time, so install-script scanners would not flag it.

A clean release, 1.20.23, was published at 21:48:03 UTC the same day, about 49 minutes after the malicious release. Version 1.20.22 was never released. The affected versions were deprecated with a security warning, and the maintainer closed GitHub issue #697 on 2026-07-08. Socket reported about 310 downloads of the malicious version; the legitimate package averages about 50,000 weekly downloads. Injective's CEO publicly disputed the download count and said there were zero downloads of the malicious package. No confirmed theft of funds has been reported. Socket publicly disclosed the compromise on 2026-07-09. Socket, Ox Security and StepSecurity are reported to have detected it. OSV tracks it as MAL-2026-10165 and GitHub as GHSA-5fc4-fm2x-6f4r.

Source discrepancies: Socket's article and Cointelegraph give the start as June 8, 2026, but the npm publish metadata cited by OffSeq and the GitHub issue timeline both give 2026-07-08, so this record uses July 8 (Socket's '22:59 GMT+2' equals 20:59 UTC). The GitHub issue describes the exfiltration target as https://hexhole.injective.network/ with the Base64 payload in an X-Request-Id header. Wiz, Socket and OffSeq instead report testnet.archival.chain.grpc-web.injective.network. Both are listed as IOCs, and the hexhole details are unconfirmed by other sources. Anyone who called PrivateKey.fromMnemonic or fromHex under 1.20.21 should treat those mnemonics and keys as compromised and move funds to newly generated wallets.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1552 Unsecured Credentials
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1071.001 Web Protocols
- T1132.001 Standard Encoding

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5002 Wallet-Key Exfiltration Endpoint Lookups for Injective gRPC-web Lookalike Hosts (Splunk SPL)** (`TL-2026-5002-SPL-003`)

Detects DNS lookups for testnet.archival.chain.grpc-web.injective.network (reported by Wiz, Socket and OffSeq) and hexhole.injective.network (GitHub issue #697, lower confidence). The compromised SDK builds the endpoint from char-code arrays to evade string scanning and POSTs Base64-encoded mnemonics and private keys over HTTPS, framed as Injective gRPC-web traffic. A lookup from a build host, CI runner or wallet-handling host indicates the stealer ran and keys may have left the environment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1132.001, T1041, T1552, T1036
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, zeek, bro:dns:json, DeviceNetworkEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
(index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 (QueryName="testnet.archival.chain.grpc-web.injective.network" OR QueryName="hexhole.injective.network")) OR (index=zeek sourcetype="bro:dns:json" (query="testnet.archival.chain.grpc-web.injective.network" OR query="hexhole.injective.network"))
```Sysmon EventCode 22 gives the querying process, Zeek gives the client IP for network-level coverage```
| eval queried_domain=coalesce(QueryName, query), client=coalesce(host, 'id.orig_h'), process=coalesce(Image, "n/a")
| stats count earliest(_time) AS first_seen latest(_time) AS last_seen values(process) AS processes by client, queried_domain
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any ("testnet.archival.chain.grpc-web.injective.network", "hexhole.injective.network")
| extend InitiatedByJsRuntime = InitiatingProcessFileName in~ ("node", "node.exe", "bun", "bun.exe", "deno", "deno.exe")
| project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, RemotePort, InitiatedByJsRuntime, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
```

### Sigma

```yaml
title: DNS Lookup for Injective Lookalike Wallet-Key Exfiltration Endpoint
id: c4e8f1a9-5d20-4b76-9e3c-1a7b6d0f2903
status: experimental
description: Detects DNS queries for testnet.archival.chain.grpc-web.injective.network and hexhole.injective.network, the endpoints used by the compromised @injectivelabs/sdk-ts 1.20.21 to exfiltrate Base64-encoded mnemonics and private keys (TL-2026-5002, MAL-2026-10165).
references:
    - https://socket.dev/blog/compromised-injective-sdk-npm-package
    - https://threats.wiz.io/all-incidents/compromised-injective-sdk-npm-package-exfiltrates-cryptocurrency-wallet-keys
    - https://github.com/InjectiveLabs/injective-ts/issues/697
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-01
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1132.001
    - attack.defense-evasion
    - attack.t1036
    - attack.exfiltration
    - attack.t1041
    - attack.credential-access
    - attack.t1552
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'testnet.archival.chain.grpc-web.injective.network'
            - 'hexhole.injective.network'
    condition: selection
falsepositives:
    - Threat-intelligence enrichment or sandbox tooling that resolves the indicator domains
    - Analysts manually testing the reported IOCs
level: critical
```

**Known false positives:**

- Threat-intelligence enrichment or sandbox tooling that resolves the indicator domains
- Analysts manually testing the reported IOCs

**Tuning notes:** hexhole.injective.network comes from a single source (GitHub issue #697) and is lower confidence, so consider a separate lower-severity alert for it. Real Injective gRPC-web hosts exist under injective.network, so match these two exact hostnames and do not wildcard the parent domain. Sibling infrastructure is not known: osint_context.json holds no community-corroborated indicators for this threat. Adapt the index and sourcetype names to your Sysmon and Zeek deployments, and add proxy or firewall logs for hosts without DNS telemetry. Prioritise alerts from CI runners and hosts that handle wallet keys.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5002 Compromised @injectivelabs npm Package 1.20.21 Installed or Resolved (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- TL-2026-5002 Injected Stealer Bundle accounts-jQ1GSgaW.js / accounts-Cy0p4lLW.cjs or Known Malicious Hash (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- TL-2026-5002 Wallet-Key Exfiltration Connections to Injective gRPC-web Lookalike Hosts (Microsoft Sentinel KQL) (locked: unlock with TL Creds)
- TL-2026-5002 Compromised @injectivelabs npm Package 1.20.21 Installed or Resolved (Sigma) (locked: unlock with TL Creds)
- TL-2026-5002 Injected Stealer Bundle accounts-jQ1GSgaW.js / accounts-Cy0p4lLW.cjs (Sigma) (locked: unlock with TL Creds)
- TL-2026-5002 DNS Lookup for Injective Lookalike Wallet-Key Exfiltration Endpoint (Sigma) (locked: unlock with TL Creds)
- TL-2026-5002 Compromised @injectivelabs npm Package 1.20.21 Installed or Resolved (Splunk SPL) (locked: unlock with TL Creds)
- TL-2026-5002 Injected Stealer Bundle accounts-jQ1GSgaW.js / accounts-Cy0p4lLW.cjs or Known Malicious Hash (Splunk SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 9)

Defanged, TLP:CLEAR.

- Domain: `testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network`
- File hash: `103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0`
- Domain: `hexhole[.]injective[.]network`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys (Wiz Threat Center)](https://threats.wiz.io/all-incidents/compromised-injective-sdk-npm-package-exfiltrates-cryptocurrency-wallet-keys)
- [Compromised Injective SDK npm Package (Socket)](https://socket.dev/blog/compromised-injective-sdk-npm-package)
- [Hackers compromise Injective npm package with malware to steal wallet keys (Cointelegraph)](https://cointelegraph.com/news/hackers-compromise-injective-npm-package-with-malware-to-steal-wallet-keys)
- [Malicious code in @injectivelabs/sdk-ts (npm) (OffSeq Threat Radar)](https://radar.offseq.com/threat/malicious-code-in-injectivelabssdk-ts-npm-81caf804a88e4ae4)
- [InjectiveLabs/injective-ts issue #697](https://github.com/InjectiveLabs/injective-ts/issues/697)
- [OSV MAL-2026-10165](https://osv.dev/vulnerability/MAL-2026-10165)
- [GitHub Advisory GHSA-5fc4-fm2x-6f4r](https://github.com/advisories/GHSA-5fc4-fm2x-6f4r)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5002