{
 "tag": "developer",
 "name": "Developer",
 "group": "Other",
 "incidents": [
  {
   "slug": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "title": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026",
   "json": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages",
   "tags": [
    "multi-evm",
    "supply-chain",
    "npm",
    "injective",
    "sdk",
    "github-compromise",
    "seed-phrase-theft",
    "developer"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23."
  }
 ],
 "changes": [
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "Socket published its analysis: the payload hooks fromMnemonic and fromHex, 17 more packages pinned the bad version, the malicious release had 310 downloads, and 1.20.23 is clean.",
   "sourceUrl": "https://socket.dev/blog/compromised-injective-sdk-npm-package",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-09",
   "title": "BleepingComputer reported the compromise and advised affected developers to move funds to new wallets and rotate all secrets.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  },
  {
   "incident": "injective-sdk-ts-npm-key-stealer-jun-2026",
   "incidentTitle": "Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-08",
   "title": "The attacker made the first suspicious commits to the Injective SDK repository and published the malicious version shortly after.",
   "sourceUrl": "https://bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer",
   "url": "https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026"
  }
 ]
}