Injective SDK release hooked wallet key derivation

A malicious release of @injectivelabs/sdk-ts, the TypeScript SDK for the Injective blockchain, reached npm on June 8, 2026 carrying code that captured wallet mnemonics and private keys as developers generated them. Socket, which detected the release, said it was live for about nineteen minutes.

The Injective SDK sees roughly 50,000 downloads a week and is the standard way to build applications against the Injective chain, which makes any code path that touches key derivation unusually valuable. The attacker took the direct route. Socket said the malicious code hooked fromMnemonic() and fromHex(), so that any developer or application deriving a wallet through the SDK handed over the full mnemonic phrase and private key material as a side effect of a normal call.

Exfiltration was designed to survive a glance at network logs. The captured material was base64-encoded and POSTed to testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network, a hostname built to read as ordinary Injective infrastructure telemetry. The malicious commits arrived from a GitHub account belonging to a developer with an established history of contributions to the repository, and the run-up is visible in the history: a branch named test-backdoor-check appeared at 20:06 GMT+2, testing access, before version 1.20.21 was published at 22:59.

Injective reverted the release by 23:18 and published a clean 1.20.23 at 23:48. npm statistics recorded 310 downloads of the bad version, and the same compromised version was pinned as a dependency across 17 other packages in the Injective scope, which extended the blast radius past the direct installs. Socket noted that the malicious version was deprecated rather than deleted and that compromised GitHub release artifacts were still present at the time of reporting. Anyone whose mnemonic or private key passed through the affected version was told to move funds and rotate keys, on the assumption that possession is the whole game.