🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
Sign In
Blog
Security NewsResearch

Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.

Karlo Zanki

July 9, 2026

4 min read

Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics
Sidebar CTA Background

Secure your dependencies with us

Socket proactively blocks malicious open source packages in your code.
Install
@injectivelabs/sdk-ts@1.20.21 records private keys and mnemonics, enabling wallet compromise via 17 scoped packages pinned to the malicious version.

Socket detected a malicious @injectivelabs/sdk-ts@1.20.21 release published to npm with fake telemetry functionality that exfiltrates wallet private keys and mnemonic phrases. The affected package is part of the Injective Labs TypeScript SDK and receives roughly 50,000 weekly downloads, making the incident significant for developers and applications that handle Injective wallet workflows.

The malicious functionality was introduced to the project’s official GitHub repository through commits submitted by a GitHub account belonging to a developer with an established history of contributions to the repository. The suspicious activity started on June 8, 2026 20:06 GMT+2 with commits likely used to test the access and rights by creating a branch called test-backdoor-check. The malicious version 1.20.21 was published at 22:59 GMT+2 but the malicious activity appears to be detected and contained relatively fast by the true owner of the developer account. A commit reverting the fix has been submitted to the GitHub repository at 23:18 GMT+2 and a clean version was published at 23:48 GMT+2. However, release artifacts belonging to the compromised version were still present in release pages of the corresponding GitHub repository at the moment of writing. Compromised version of the package was deprecated in npm but still not removed at the moment of writing.

The impact extends beyond direct users of @injectivelabs/sdk-ts. The threat actor also published version 1.20.21 across 17 additional @injectivelabs scoped packages that depended on and pinned the malicious SDK version, exposing transitive users who may not have installed @injectivelabs/sdk-ts directly.

Socket package view for npm/@injectivelabs/sdk-ts, showing a known-malware alert.

Compromised Packages and Versions#

Only one version of the @injectivelabs/sdk-ts package contains the malicious functionality, but other packages from the @injectivelabs scope have a version 1.20.21 released and each of them has a dependency to the @injectivelabs/sdk-ts package pinned to the malicious version 1.20.21

Malicious versions of the packages from the scope that directly or transitively depend on the malicious version of the compromised package:

The Stealer Functionality#

The malicious functionality is minimalistic and straightforward. The execution is not triggered at install time, but rather during usage of the library functionality. Such approach usually helps keep the malicious functionality under the radar. The malicious code is located in /dist/esm/accounts-jQ1GSgaW.js and /dist/cjs/accounts-Cy0p4lLW.cjs files. The functions fromMnemonic and fromHex used in regular workflows to generate private keys are hooked with a call to the trackKeyDerivation function.

var PrivateKey = class PrivateKey {
	constructor(wallet) {
		require_defineProperty._defineProperty(this, "wallet", void 0);
		this.wallet = wallet;
	}
	/**
	* Generate new private key with random mnemonic phrase
	* @returns { privateKey: PrivateKey, mnemonic: string }
	*/
	static generate() {
		const mnemonic = (0, __scure_bip39.generateMnemonic)(__scure_bip39_wordlists_english.wordlist);
		return {
			privateKey: PrivateKey.fromMnemonic(mnemonic),
			mnemonic
		};
	}
	/**
	* Create a PrivateKey instance from a given mnemonic phrase and a HD derivation path.
	* If path is not given, default to Band's HD prefix 494 and all other indexes being zeroes.
	* @param {string} words the mnemonic phrase
	* @param {string|undefined} path the HD path that follows the BIP32 standard (optional)
	* @returns {PrivateKey} Initialized PrivateKey object
	*/
	static fromMnemonic(words, path = require_constants.DEFAULT_DERIVATION_PATH) {
		trackKeyDerivation("fm", words);
		return new PrivateKey(new ethers.Wallet(ethers.HDNodeWallet.fromPhrase(words, void 0, path).privateKey));
	}
A hooked call to the malicious trackKeyDerivation function responsible for data logging and exfiltration. Arguments passed to the function include a hardcoded marker describing the method used to generate the private key and the actual sensitive information needed for generating the private key. With these information threat actors can regenerate the private key in their environment.

This function records key derivation events by logging method used to create derivation and the sensitive information used to derive the key. In the case of the fromMnemonic function, the full mnemonic phrase is recorded, and in the case of the fromHex function, the private-key material or a representation of it is recorded. Finally these records are base64-encoded and silently exfiltrated through a POST request to a char-obfuscated public infrastructure endpoint https://testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network. By using public infrastructure endpoints belonging to InjectiveLabs, the threat actor blends the network traffic generated during exfiltration with the network traffic generated during typical usage of InjectiveLabs’ software products. The exfiltrated material is sufficient for threat actor to recreate private keys and get access to wallets containing victims crypto assets.

Impact#

The compromised @injectivelabs/sdk-ts is a popular package with approximately 50,000 weekly downloads. It has 87 dependent packages according to npm data and the number of transitive dependencies is likely even larger. The threat actor tried to amplify the impact by simultaneously publishing version 1.20.21 across several other npm packages under the @injectivelabs scope. These packages included a direct or transitive dependencies to the compromised package which were pinned to the malicious versions 1.20.21.

While the compromise was quickly detected by the developer whose account was used to create the malicious commits, the campaign itself isn’t yet fully contained. The malicious version of the compromised package hasn’t yet been removed from the npm repository, but only deprecated with a warning message from the author that it is a compromised version and it shouldn’t be used. However, this means that the version is still present and downloadable. Same goes for the release artifacts in the GitHub repository.

Version information from npm repository proving that the malicious version has been deprecated but not yet removed. According to the official stats, the malicious version has been downloaded 310 times. The true impact can be considered relatively insignificant, given the potential impact based on the popularity of the project. The bigger damage was averted thanks to the quick reaction from the developer behind the compromised GitHub account.

Defensive Guidance#

Recommended actions for developers:

  1. Audit your package.json for packages from @injectivelabs scope not pinned to a specific version that could be resolved to version 1.20.21. Change them to the newly published, clean version 1.20.23.
  2. Any private key or mnemonic phrase passed through these packages should be treated as compromised. Move funds and rotate keys and mnemonics.
  3. Check for transitive dependencies. Threat actors purposely published versions of packages that depend on @injectivelabs/sdk-ts package and had them pinned to the malicious version 1.20.21, so auditing direct dependencies is not sufficient.

Indicators of Compromise#

Compromised npm packages

SHA-256 Hashes

  • 103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0 - /dist/cjs/accounts-Cy0p4lLW.cjs file containing the infostealer functionality
  • 9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9 /dist/esm/accounts-jQ1GSgaW.js file containing the infostealer functionality
Sidebar CTA Background

Secure your dependencies with us

Socket proactively blocks malicious open source packages in your code.
Install

Subscribe to our newsletter

Get notified when we publish new security blog posts!

Related posts

Back to all posts
White House Launches Gold Eagle Initiative to Manage Surge in AI-Discovered Vulnerabilities

Security News

White House Launches Gold Eagle Initiative to Manage Surge in AI-Discovered Vulnerabilities

The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.

By Sarah Gooding  -  Jul 17, 2026
Next.js moves to scheduled security releases

Security News

Next.js moves to scheduled security releases

Vercel is formalizing a monthly release program for Next.js. The change follows React2Shell and a sharp rise in AI-assisted vulnerability discovery.

By Sarah Gooding  -  Jul 16, 2026