Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys
npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages
Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23.
Why this severity: Many people exposed.
- Started
- Jun 8, 2026
- Closed
- Jul 9, 2026
- Chains
- Multiple EVM chains
- Method
- Supply-chain stealers
At risk
- npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages
- Multiple EVM chains wallets
What to do now
- Search package.json and lockfiles for @injectivelabs packages at 1.20.21, upgrade to 1.20.23 and clear package caches.
- Move funds out of any wallet whose seed or key passed through the affected code, then rotate every secret on that machine or CI runner.
Stay safe
Am I affected?
If any project, server or CI job of yours installed @injectivelabs/sdk-ts 1.20.21 (directly, or through another @injectivelabs package at 1.20.21) and then loaded a wallet from a seed phrase or private key.
What to do now
- Search package.json and lockfiles for @injectivelabs packages at 1.20.21, upgrade to 1.20.23 and clear package caches.
- Move funds out of any wallet whose seed or key passed through the affected code, then rotate every secret on that machine or CI runner.
How to avoid this
- Pin dependency versions, review lockfile changes and wait before adopting brand-new releases of packages that handle keys.
- Run a dependency scanner in CI.
- Keep production keys out of scripts and developer machines; use hardware wallets or a KMS.
Timeline 3
BleepingComputer reported the compromise and advised affected developers to move funds to new wallets and rotate all secrets.
SourceSocket published its analysis: the payload hooks fromMnemonic and fromHex, 17 more packages pinned the bad version, the malicious release had 310 downloads, and 1.20.23 is clean.
SourceThe attacker made the first suspicious commits to the Injective SDK repository and published the malicious version shortly after.
Source
Alerts & on-chain evidence 1
News & write-ups ›1
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.