Injective SDK npm package compromised, wallet keys stolen

A sophisticated software supply-chain attack targeting developers using the Injective blockchain's software development kit has been uncovered by security researchers. The attack, which occurred on July 8, 2026, involved a compromised GitHub account belonging to a legitimate project contributor, allowing attackers to push a malicious version of a widely used npm package for approximately 17 minutes.

The malicious code was inserted into version 1.20.21 of the injectivelabssdkts npm package, which averages about 50,000 weekly downloads. The attackers gained direct push access to the project's master branch, bypassing standard code review processes. The tainted version was then propagated across 17 other associated packages under the Injective Labs scope, each pinned to the compromised release. Security firms Socket, StepSecurity, and Ox Security detected the campaign.

Instead of executing upon installation, the malware activated stealthily at runtime when developers used specific wallet key-generation functions within their applications. The code intercepted the PrivateKey.fromMnemonic function, capturing private keys and mnemonic seed phrases. It then encoded the stolen data and...