A malicious version of Injective Labs' JavaScript SDK was published to npm after attackers compromised a contributor account, putting developers and downstream crypto apps at risk of wallet theft. The poisoned release was @injectivelabs/sdk-ts version 1.20.21, and 17 related packages were pinned to it. The malware triggered when wallet-generation or wallet-import functions were used, then exfiltrated mnemonic seed phrases and private keys via HTTP requests disguised as legitimate traffic. Injective later published clean version 1.20.23.
Why it matters: Developers who installed or used the affected package may have exposed wallet secrets that let attackers drain funds, so this is urgent for cryptocurrency projects and users tied to those wallets. Affected teams should audit dependencies, rotate environment secrets, and move funds to new wallets if any seed phrase or private key may have been handled by the malicious version.
info@thehackernews.com (The Hacker News)
2026.07.10
98% relevant
This article appears to cover the same underlying event, adding that a GitHub compromise at Injective Labs was the mechanism used to push the malicious npm packages that stole wallet seed phrases and private keys.
Bill Toulas
2026.07.09
100% relevant
This article establishes a distinct npm supply-chain compromise centered on Injective Labs' SDK, with a specific malicious package version, attack path through a compromised contributor account, and concrete impact of stolen wallet credentials.
← Back to all stories