Injective Labs npm Supply Chain Compromise (@injectivelabs/sdk-ts)

Technical Analysis

The attackers gained unauthorized access to the Injective Labs SDK GitHub repository and injected malicious code into a new package release, @injectivelabs/sdk-ts@1.20.21, published to the npm registry. The malicious payload was disguised as telemetry functionality but actually harvested cryptocurrency wallet private keys and BIP-39 mnemonic seed phrases, exfiltrating them to attacker-controlled infrastructure. This is a classic npm supply-chain attack pattern, relying on developers or CI/CD pipelines auto-updating to the compromised version without verifying provenance or reviewing changelogs. Organizations running AI agents or automated coding/build pipelines that programmatically pull dependencies (including agent-driven package managers or autonomous DevOps agents) could unknowingly install this package and have embedded wallet credentials or API keys exfiltrated, and agentic systems with blockchain/wallet integration are directly at risk of key theft.

Affected Systems

npm package @injectivelabs/sdk-ts version 1.20.21; any Node.js/TypeScript projects, dApps, backend services, or bots that depend on this SDK version; developer and CI/CD environments with cryptocurrency wallet private keys or mnemonic seed phrases present in environment variables or local storage

Indicators of Compromise

• Package: @injectivelabs/sdk-ts@1.20.21
• Behavior: fake telemetry function exfiltrating wallet private keys and mnemonic seed phrases
• Distribution: npm registry (registry.npmjs.org)
• Source: compromised Injective Labs SDK GitHub repository

Remediation Steps

1. 1

   Remove compromised package version

   Immediately audit package-lock.json/yarn.lock files and uninstall or downgrade @injectivelabs/sdk-ts to a verified clean version prior to 1.20.21.

2. 2

   Rotate compromised secrets

   Treat any wallet private keys, mnemonic seed phrases, or API keys present on systems that installed the malicious package as compromised; rotate and move funds to new wallets immediately.

3. 3

   Audit CI/CD and build pipelines

   Review automated dependency update logs and CI/CD pipelines for installation of the affected version and any outbound network connections to unknown exfiltration endpoints.

4. 4

   Enable dependency pinning and integrity checks

   Use lockfiles, npm provenance/signature verification, and automated SCA tooling to detect unauthorized package changes before deployment.

5. 5

   Review GitHub repository access controls

   For maintainers, enforce mandatory 2FA, restrict publish tokens, and audit recent commits/releases for unauthorized changes.