# Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys

- Severity: High · Status: Contained (past)
- Chains: Multiple EVM chains · Method: Supply-chain stealers
- Started: Jun 8, 2026 · Last update: Jul 9, 2026
- Who/what: npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages

Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23.

## Am I affected?
If any project, server or CI job of yours installed @injectivelabs/sdk-ts 1.20.21 (directly, or through another @injectivelabs package at 1.20.21) and then loaded a wallet from a seed phrase or private key.

## What to do now
- Search package.json and lockfiles for @injectivelabs packages at 1.20.21, upgrade to 1.20.23 and clear package caches.
- Move funds out of any wallet whose seed or key passed through the affected code, then rotate every secret on that machine or CI runner.

## How to avoid this
- Pin dependency versions, review lockfile changes and wait before adopting brand-new releases of packages that handle keys.
- Run a dependency scanner in CI.
- Keep production keys out of scripts and developer machines; use hardware wallets or a KMS.

## Sources
- Compromised Injective SDK npm package (Socket, 2026-07-09): https://socket.dev/blog/compromised-injective-sdk-npm-package
- Injective SDK on npm infected with cryptocurrency wallet stealer (BleepingComputer, 2026-07-09): https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer

Full record: https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026 · JSON: https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.