Malicious NPM Package Steals Crypto Wallet Secrets from Injective Labs

Unknown threat actors compromised the Injective Labs SDK project’s GitHub repository and leveraged it to publish a malicious package on the npm registry that steals cryptocurrency wallet private keys and mnemonic seed phrases.¹

The version @injectivelabs/sdk-ts@1.20.21 was embedded with fake telemetry functionality that exfiltrated data from wallets.¹

The injected code quietly collected sensitive information whenever users interacted with their wallet via the SDK. By disguising itself as legitimate telemetry, the malware avoided detection by standard security scanners while still transmitting stolen secrets back to an attacker‑controlled server.

Developers were warned to avoid installing the new 1.20.21 release until further investigation could confirm its integrity. Security teams at Injective Labs are conducting forensic analysis of the repository to identify how the compromise occurred and to patch any exposed credentials or access tokens in the build pipeline.¹

This incident echoes earlier supply‑chain attacks such as Codecov’s Bash variable injection in 2019, where attackers exploited typosquatting to inject malicious payloads into seemingly benign packages. NPM has increased security checks since then, yet vulnerabilities persist because developers often trust open‑source dependencies without rigorous auditing. Users should expect stricter dependency‑auditing tools going forward alongside runtime integrity monitoring across all smart contracts interacting through compromised SDKs.

Mitigation steps include verifying package signatures before installation, using lockfiles that pin exact versions, and employing automated tools like npm audit or Snyk to flag known vulnerable modules. For critical libraries such as @injectivelabs/sdk-ts, organizations might also consider running code‑review pipelines that detect suspicious telemetry patterns or outbound connections during development builds.

The broader implication is a reminder that even well‑known projects can be subverted if their source repositories fall under threat actor control. Supply‑chain vigilance—checking commit histories, reviewing contributor permissions, and maintaining separate CI/CD environments for production releases—is essential to protect users from key‑stealing malware hidden behind legitimate APIs.