Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK GitHub repository and published a malicious npm package that stole cryptocurrency wallet private keys and mnemonic seed phrases from users who installed it.
- Disclosed
- Last updated
- Blast radius
- Unknown number of npm users who installed the malicious Injective SDK package; potential impact on cryptocurrency holdings of affected users.
- Ecosystems
- Attack vectors
- Affected entities
- Injective SDKMalicious package published on npm
The Injective Labs SDK project on GitHub was compromised by attackers who gained unauthorized access to the repository. Using this access, the attackers published a malicious version of the Injective SDK package to the Node Package Manager (npm) registry.\n\nThe malicious package contained code designed to steal sensitive cryptocurrency wallet information, specifically private keys and mnemonic seed phrases, from users who installed or ran the compromised package. This type of attack directly threatens the security of cryptocurrency holdings for any developer or user who executed the malicious code.\n\nThe incident represents a supply chain attack targeting the npm ecosystem, where a legitimate project's distribution channel was weaponized to deliver wallet-stealing malware to downstream users.
Remediation
- Immediately remove or uninstall the malicious Injective SDK package from all systems
- Audit npm package installation history to identify when the malicious version was installed
- If the malicious package was executed, treat all associated cryptocurrency wallets as compromised and transfer funds to new wallets with fresh keys
- Review GitHub repository access logs and revoke compromised credentials
- Enable multi-factor authentication on GitHub and npm accounts
- Monitor affected cryptocurrency wallets for unauthorized transactions
- Check npm audit logs and consider using npm package integrity verification tools
Sources
- Injective SDK on npm infected with cryptocurrency wallet stealer · BleepingComputer
Cite this entry
"Injective SDK on npm infected with cryptocurrency wallet stealer." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 9, 2026; last updated July 9, 2026. https://supplychainattack.org/incident/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer-y0s9hj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in mutex-thread (npm)
The npm package mutex-thread contained injected malicious code that spawns obfuscated dropper payloads, exfiltrates host reconnaissance data to Slack and Telegram, and executes remotely-controlled commands fetched from an Ethereum smart contract on Sepolia testnet.
npmCompromised packageMalicious commit - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in agora402-payment-utils (npm)
The npm package agora402-payment-utils contains malicious code that replaces caller-supplied recipient addresses with a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08) in payment routing functions. Additionally, a postinstall script exfiltrates installer metadata to an external webhook without consent.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @mohamed_nowisar/token3-check (npm)
The npm package @mohamed_nowisar/token3-check contained malicious code in preinstall, install, and postinstall lifecycle hooks that exfiltrated system and CI environment information to a third-party webhook endpoint without user consent.
npmCompromised packageMalicious commit