Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys

On July 8, 2026, attackers gained access to a trusted developer's npm account and injected backdoored code into 18 packages of the Injective blockchain SDK. The malicious code, disguised as analytics, stole wallet recovery phrases and private keys, exfiltrating them to an attacker-controlled server. The compromise was detected and remediated within an hour.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
18 npm packages related to the Injective blockchain SDK; any application that installed affected packages during the compromise window or from cached copies
Ecosystems
npm
Attack vectors
Account takeoverCompromised package
Affected entities
  • Injective blockchain SDK packages18 related packages compromised via backdoored code

On July 8, 2026, attackers compromised a trusted developer's npm account and used it to inject malicious code into 18 related packages of the Injective blockchain SDK. The backdoor was disguised as harmless analytics functionality but actually captured sensitive wallet data including recovery phrases and private keys.

The malicious code exfiltrated stolen credentials to an attacker-controlled server whenever a wallet was created or loaded. Automatic publishing mechanisms distributed the tainted code across all 18 packages within minutes of the initial compromise.

The backdoored packages remained live for less than an hour before being detected, pulled from npm, and fixed. However, any application that installed the affected packages during the compromise window or subsequently retrieved cached copies may have been affected and should treat any wallet secrets handled by those packages as compromised.

This incident demonstrates the critical risk of account takeover attacks against trusted developers in the cryptocurrency ecosystem, where a single compromised account can rapidly distribute malicious code to multiple dependent packages.

Indicators of compromise

Packages
  • Injective blockchain SDK (18 related packages - specific names not provided in source)

Remediation

  • Immediately revoke and rotate any wallet recovery phrases and private keys that may have been exposed to the affected packages
  • Audit application logs to determine if any of the 18 affected Injective SDK packages were installed during the July 8, 2026 compromise window
  • Clear npm cache and reinstall packages from verified, patched versions only
  • Implement strict package pinning and integrity verification for critical dependencies
  • Enable 2FA and use hardware security keys on all npm accounts with publishing rights
  • Monitor for unauthorized account access and publishing activity on developer accounts
  • Consider using private npm registries with additional access controls for sensitive blockchain-related packages

Sources

  1. Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys · StepSecurity

Cite this entry

"Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 8, 2026; last updated July 9, 2026. https://supplychainattack.org/incident/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-1wx0ka

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in @telekom-ods/react-ui-kit (npm)

    @telekom-ods/react-ui-kit version 2.6.9 on npm contained malicious code in an install hook that exfiltrated system information (/etc/passwd, /etc/hosts, /etc/shadow, id output) via HTTP POST to an OAST callback server. The compromised package was published under the legitimate telekom-ods publisher account, suggesting either account takeover or supply-chain injection.

    npmCompromised packageAccount takeover
  2. activecritical

    ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2

    ChainDrop is a self-propagating npm worm that publishes malicious versions of dozens of npm packages using stolen maintainer credentials. The worm harvests CI/CD credentials and uses an Ethereum-based dead-drop command-and-control mechanism.

    ChaindropnpmOtherCompromised packageMalicious maintainerAccount takeover
  3. containedcritical

    Malicious code in @antv/li-editor (npm)

    A threat actor compromised the npm account `atool` and published 631 malicious versions across 314 npm packages, including @antv/li-editor, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit
  4. activecritical

    Malicious code in @antv/l7-scene (npm)

    The npm account `atool` was compromised and used to publish 631 malicious versions across 314 packages, including @antv/l7-scene, in a 22-minute automated burst. Each version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials via the GitHub API and establishes persistence through CI/CD workflow injection and system daemons.

    Mini Shai HuludTeamPCPnpmAccount takeoverCompromised package