Injective's npm SDK Was Backdoored to Steal Seed Phrases

Injective Labs' official TypeScript software development kit was published to npm carrying a backdoor built to steal wallet secrets. The malicious release, @injectivelabs/sdk-ts version 1.20.21, contained a function disguised as telemetry and named trackKeyDerivation(), which hooked into wallet-creation and wallet-access calls in order to capture mnemonic seed phrases — the word lists from which an entire wallet can be reconstructed — along with private key derivation material. The captured data was base64-encoded, hidden inside an ordinary HTTP request header and sent out by HTTPS POST to an endpoint on Injective's own infrastructure, which is why the traffic did not look anomalous to anything watching it. Injective deprecated the version and shipped a clean 1.20.23, with the turnaround reported at about 49 minutes, and told users to treat any credential the package had handled as compromised and to rotate keys and mnemonics. No figure for what was actually stolen has been published.

The Dependency: What an npm Package Is and Where It Ends Up

npm is the public registry that JavaScript and TypeScript developers install code from, and a package is a versioned unit of that code, pulled in by a single command along with everything it in turn depends on. A software development kit is the package a project publishes so that others can talk to its chain without writing the low-level plumbing themselves. Wallet software, exchange interfaces and trading tools install it, and it then runs inside the application at precisely the point where a user enters a seed phrase or the application generates one. Nothing separates the two: the library and the secret share the same process and the same memory. That is why malicious code arriving through a trusted third party can reach end users' keys without touching a smart contract or a blockchain at all.

The Payload: A Contributor's GitHub Account With Publish Rights

The root cause was not a flaw in Injective's code. A GitHub account belonging to a legitimate project contributor was compromised, which handed the attacker the ability to publish to npm under the project's name, according to The Hacker News. Everything downstream of that followed the normal release path: a version number that looked like any other patch, a function name that read like instrumentation, and exfiltration aimed at a subdomain the SDK already talked to. Developers auditing their traffic would have seen requests to Injective going to Injective. The one visible tell was the header the stolen material was smuggled in, a request identifier field that no wallet library has reason to fill with encoded secrets.

The Blast Radius: 17 Pinned Packages and 87 Dependents

Seventeen further scoped packages were pinned to the poisoned SDK, among them private-key, EVM and Cosmos modules and the wallet implementations for Trezor and Ledger hardware devices, according to StepSecurity. The compromised version itself was downloaded 310 times before it was deprecated, but 87 dependent packages carrying more than 112,000 cumulative downloads were exposed through it. Estimates of how widely the parent package is used differ: BleepingComputer put it at roughly 50,000 weekly downloads, while Startup Fortune put it at roughly 175,000 monthly downloads, and the two figures do not reconcile. Reported timelines differ as well — The Hacker News dates the malicious release to July 8, while BleepingComputer traces the first suspicious commits back to June 8, which would mean a month of exposure rather than a day.

What Is Unresolved: Credentials That Must Be Assumed Compromised

Rotation is the only remedy available once keys have been exposed by the software that generated or handled them, and rotation is a manual act that most affected users will never learn they need to perform. A deprecated npm version stays installed in every project that already resolved it, and lock files and cached builds keep bad code in circulation long after the registry entry is marked. There is still no published loss total, which means the incident cannot yet be sized, and the disputed start date leaves the exposure window itself unsettled. The structural point is narrower and harder to fix: publishing rights to a package that thousands of applications trust rested on the security of one contributor's personal account, and nothing about a 49-minute fix changes what that account could do in the meantime.