Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
Injective Labs' GitHub repository was compromised, allowing threat actors to publish a malicious package on the npm registry that steals cryptocurrency wallet private keys and mnemonic seed phrases.
Intelligence analysis by Llama
A malicious package was published on the npm registry, compromising the private keys and mnemonic seed phrases of cryptocurrency wallets. The package was published by Injective Labs' GitHub repository, which was compromised by threat actors.
Imagine you're using a library to help you manage your cryptocurrency wallet. But someone sneaky has added a hidden feature that steals your private keys and mnemonic seed phrases. This is what happened to Injective Labs' GitHub repository, where a malicious package was published on the npm registry.
Analysis
A Malicious Package on the Loose
The Injective Labs GitHub repository was compromised, allowing threat actors to publish a malicious package on the npm registry. The package, @injectivelabs/sdk-ts@1.20.21, was designed to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version was released on July 8, 2026, but has since been deprecated on the registry. However, the release artifacts belonging to the compromised version are still available for download from GitHub as of writing.
How the Attack Unfolded
The malicious functionality was introduced to the project's official GitHub repository through commits submitted by a GitHub account belonging to a developer with an established history of contributions to the repository. The threat actor behind the attack also published version 1.20.21 across 17 additional @injectivelabs scoped packages that depended on and pinned the malicious SDK version. This includes @injectivelabs/utils, @injectivelabs/networks, @injectivelabs/ts-types, and many others.
The Malware's Modus Operandi
The malware present within the package is fairly simple and straightforward. It gets triggered when the library functionality is used by an unsuspecting developer. By avoiding lifecycle scripts and not launching it during the installation phase, it helps the malware fly under the radar. Specifically, the poisoned version has been found to modify legitimate functions used in workflows to generate private keys by invoking a 'trackKeyDerivation()' function under the guise of collecting anonymized usage metrics for SDK optimization.
The Consequences of the Compromise
Users who have installed the malicious version are recommended to update to the newly published, clean version of the package (1.20.23), treat any private key or mnemonic phrase passed through the package as compromised and rotate them, and check for transitive dependencies.
Key points
- Injective Labs' GitHub repository was compromised, allowing threat actors to publish a malicious package on the npm registry.
- The package was designed to steal cryptocurrency wallet private keys and mnemonic seed phrases.
- The compromised version was released on July 8, 2026, but has since been deprecated on the registry.
- The release artifacts belonging to the compromised version are still available for download from GitHub as of writing.
- Users who have installed the malicious version are recommended to update to the newly published, clean version of the package (1.20.23).
The compromise highlights the importance of software supply chain security, and developers are now more vigilant when using open-source libraries. This increased awareness could lead to better security practices and fewer compromises in the future.
The compromise shows that even reputable projects like Injective Labs can be vulnerable to attacks. This highlights the need for developers to regularly update their dependencies and be cautious when using open-source libraries.
