Injective SDK npm Supply Chain Wallet Stealer

Technical Analysis

The threat actors gained unauthorized access to the Injective SDK's source GitHub repository, allowing them to inject malicious code that was subsequently published as a legitimate-looking update on npm. The payload was designed to scan for and exfiltrate cryptocurrency wallet private keys and mnemonic seed phrases, likely via environment variable scraping, filesystem searches, or hooking into wallet-related SDK functions, then transmitting the stolen data to an attacker-controlled endpoint. This is a classic npm supply-chain attack vector, where compromised upstream credentials or CI/CD pipelines are leveraged to poison packages trusted by downstream developers. Because AI agent frameworks and autonomous crypto-trading or DeFi bots frequently pull SDKs like this to interact with blockchain wallets programmatically, any agent system integrating the compromised Injective SDK could have its wallet credentials, API keys, or signing keys silently exfiltrated, leading to direct financial loss and broader credential compromise across agent-orchestrated pipelines.

Affected Systems

npm package(s) published under the Injective Labs SDK name; Node.js projects, DeFi applications, trading bots, and AI agent integrations that installed the compromised package version(s) from npm during the exposure window

Indicators of Compromise

• Malicious Injective SDK npm package (specific compromised version not disclosed in source)
• GitHub repository compromise indicator: unauthorized commits/publishes to Injective Labs SDK repo
• Exfiltration of wallet private keys and mnemonic seed phrases (behavioral IOC)

Remediation Steps

1. 1

   Audit and pin dependencies

   Immediately review project package-lock.json/yarn.lock for the Injective SDK package version installed; roll back to a verified clean version or remove it entirely.

2. 2

   Rotate compromised credentials

   Treat any wallet private keys, mnemonic seed phrases, and API keys present on systems that installed the affected package as compromised; generate new wallets/keys and migrate funds immediately.

3. 3

   Verify package integrity

   Use npm provenance, checksums, and signature verification for future installs; enable lockfile integrity checks in CI/CD pipelines.

4. 4

   Scan for exfiltration activity

   Review network logs and endpoint telemetry for outbound connections coinciding with the malicious package's install/postinstall scripts.

5. 5

   Harden GitHub repository access

   For maintainers, enforce MFA, restrict publish tokens, use scoped and short-lived npm tokens, and require signed commits/releases to prevent repository takeover.

6. 6

   Audit AI agent and automation pipelines

   Check any AI agent or automated trading systems that depend on the Injective SDK or similar crypto SDKs for exposure, and rotate any keys those agents used to interact with wallets or exchanges.