Injective's npm SDK Was Backdoored to Steal Seed Phrases

Injective Labs' official TypeScript software development kit was published to npm carrying a backdoor built to steal wallet secrets. The malicious release, @injectivelabs/sdk-ts version 1.20.21, contained a function disguised as telemetry and named trackKeyDerivation(), which hooked into wallet-creation and wallet-access calls to capture mnemonic seed phrases, the word lists from which an entire wallet can be reconstructed, along with private key derivation material. The captured data was base64-encoded, hidden inside an ordinary HTTP request header and sent out by HTTPS POST to an endpoint on Injective's own infrastructure. The traffic therefore did not look anomalous to anything watching it. Injective deprecated the version and shipped a clean 1.20.23, a turnaround reported at about 49 minutes, and told users to treat any credential the package had handled as compromised and to rotate keys and mnemonics. No figure for what was actually stolen had been published at the time of writing.

Where an npm package ends up

npm is the public registry that JavaScript and TypeScript developers install code from, and a package is a versioned unit of that code, pulled in by a single command along with everything it in turn depends on. A software development kit is the package a project publishes so that others can talk to its chain without writing the low-level plumbing themselves. Wallet software, exchange interfaces and trading tools install it, and it then runs inside the application at precisely the point where a user enters a seed phrase or the application generates one. Nothing separates the two. The library and the secret share the same process and the same memory, and that is how malicious code arriving through a trusted third party can reach end users' keys without touching a smart contract or a blockchain at all.

A contributor's account with publish rights

The root cause was not a flaw in Injective's code. A GitHub account belonging to a legitimate project contributor was compromised, The Hacker News reported, and that handed the attacker the ability to publish to npm under the project's name. Everything downstream followed the normal release path: a version number that looked like any other patch and a function name that read like instrumentation, with exfiltration aimed at a subdomain the SDK already talked to. Developers auditing their traffic would have seen requests to Injective going to Injective. The one visible tell was the header the stolen material was smuggled in, a request identifier field that no wallet library has reason to fill with encoded secrets.

17 pinned packages and 87 dependents

StepSecurity counted seventeen further scoped packages pinned to the poisoned SDK, among them private-key, EVM and Cosmos modules and the wallet implementations for Trezor and Ledger hardware devices. The compromised version itself was downloaded 310 times before it was deprecated, but 87 dependent packages carrying more than 112,000 cumulative downloads were exposed through it. How widely the parent package is used is itself in dispute. BleepingComputer put it at roughly 50,000 weekly downloads; Startup Fortune put it at roughly 175,000 monthly downloads. The two figures do not reconcile. The timelines disagree as well: The Hacker News dates the malicious release to July 8, while BleepingComputer traces the first suspicious commits back to June 8, which would mean a month of exposure rather than a day.

Credentials that have to be assumed compromised

Rotation is the only remedy once keys have been exposed by the software that generated or handled them, and rotation is a manual act that most affected users will never learn they need to perform. A deprecated npm version stays installed in every project that already resolved it. Lock files and cached builds keep bad code in circulation long after the registry entry is marked. There is still no loss total. Until one appears the incident cannot be sized, and the disputed start date leaves the exposure window itself unsettled; we could not establish which date is right. The structural point is narrower and harder to fix: publishing rights to a package that thousands of applications trust rested on the security of one contributor's personal account, and nothing about a 49-minute fix changes what that account could do in the meantime.