{
 "slug": "injective-sdk-ts-npm-key-stealer-jun-2026",
 "title": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
 "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026",
 "json": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "multi-evm"
 ],
 "method": "supply-chain",
 "product": "npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages",
 "tags": [
  "multi-evm",
  "supply-chain",
  "npm",
  "injective",
  "sdk",
  "github-compromise",
  "seed-phrase-theft",
  "developer"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-06-08",
 "closedAt": "2026-07-09",
 "updatedAt": "2026-07-09T12:00:00Z",
 "summary": "Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23.",
 "timeline": [
  {
   "date": "2026-06-08",
   "title": "The attacker made the first suspicious commits to the Injective SDK repository and published the malicious version shortly after.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer"
  },
  {
   "date": "2026-07-09",
   "title": "Socket published its analysis: the payload hooks fromMnemonic and fromHex, 17 more packages pinned the bad version, the malicious release had 310 downloads, and 1.20.23 is clean.",
   "sourceUrl": "https://socket.dev/blog/compromised-injective-sdk-npm-package"
  },
  {
   "date": "2026-07-09",
   "title": "BleepingComputer reported the compromise and advised affected developers to move funds to new wallets and rotate all secrets.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer"
  }
 ],
 "sources": [
  {
   "kind": "advisory",
   "title": "Compromised Injective SDK npm package",
   "url": "https://socket.dev/blog/compromised-injective-sdk-npm-package",
   "publisher": "Socket",
   "date": "2026-07-09"
  },
  {
   "kind": "news",
   "title": "Injective SDK on npm infected with cryptocurrency wallet stealer",
   "url": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "publisher": "BleepingComputer",
   "date": "2026-07-09"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf any project, server or CI job of yours installed @injectivelabs/sdk-ts 1.20.21 (directly, or through another @injectivelabs package at 1.20.21) and then loaded a wallet from a seed phrase or private key.\n\n## What to do now\n- Search package.json and lockfiles for @injectivelabs packages at 1.20.21, upgrade to 1.20.23 and clear package caches.\n- Move funds out of any wallet whose seed or key passed through the affected code, then rotate every secret on that machine or CI runner.\n\n## How to avoid this\n- Pin dependency versions, review lockfile changes and wait before adopting brand-new releases of packages that handle keys.\n- Run a dependency scanner in CI.\n- Keep production keys out of scripts and developer machines; use hardware wallets or a KMS.",
 "notes": null,
 "agentBrief": "# Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys\n\n- Severity: High · Status: Contained (past)\n- Chains: Multiple EVM chains · Method: Supply-chain stealers\n- Started: Jun 8, 2026 · Last update: Jul 9, 2026\n- Who/what: npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages\n\nAttackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23.\n\n## Am I affected?\nIf any project, server or CI job of yours installed @injectivelabs/sdk-ts 1.20.21 (directly, or through another @injectivelabs package at 1.20.21) and then loaded a wallet from a seed phrase or private key.\n\n## What to do now\n- Search package.json and lockfiles for @injectivelabs packages at 1.20.21, upgrade to 1.20.23 and clear package caches.\n- Move funds out of any wallet whose seed or key passed through the affected code, then rotate every secret on that machine or CI runner.\n\n## How to avoid this\n- Pin dependency versions, review lockfile changes and wait before adopting brand-new releases of packages that handle keys.\n- Run a dependency scanner in CI.\n- Keep production keys out of scripts and developer machines; use hardware wallets or a KMS.\n\n## Sources\n- Compromised Injective SDK npm package (Socket, 2026-07-09): https://socket.dev/blog/compromised-injective-sdk-npm-package\n- Injective SDK on npm infected with cryptocurrency wallet stealer (BleepingComputer, 2026-07-09): https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer\n\nFull record: https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026 · JSON: https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}