Injective Labs SDK npm compromise steals wallet keys and mnemonics

Confirmed

Discovered Jul 9, 2026

A compromised maintainer account pushed wallet-key exfiltration code through Injective’s trusted GitHub Actions publisher into 18 npm packages.

Affected Packages

Observables

Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Current dossier state: needs review
Last verified: Not yet independently verified
Am I affected?: @injectivelabs/wallet-cosmos-strategy, @injectivelabs/sdk-ts, @injectivelabs/utils, @injectivelabs/networks
Immediate action: Audit locks, CI runners, developer workstations, and credential exposure.
Hunting: Has hunting script

Observed fact

Direct-source and cited evidence only.

Informed inference

Analysis is labelled where evidence is indirect.

Unknown

Unverified scope remains explicitly open.

Copy IOCs Run hunting script View sources Jump to remediation

src/utils/key-derivation-telemetry[.]ts
testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network
dist/cjs/accounts-Cy0p4lLW[.]cjs
testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network
dist/esm/accounts-jQ1GSgaW[.]js

Analysis

Executive Summary

A compromised maintainer account pushed wallet-key exfiltration code through Injective’s trusted GitHub Actions publisher into 18 npm packages. The cited researchers identify the execution trigger as runtime calls to PrivateKey.fromMnemonic() or PrivateKey.fromHex() and the observed behavior as: base64-encodes wallet recovery material and sends it in X-Request-Id on a disguised gRPC-Web POST. [1] [2]

Responders should treat a matching malicious version as exposure and seek execution or egress evidence before asserting data theft. Secrets at risk include Injective wallet private keys, mnemonic phrases, and funds controlled by those keys. No public victim count is treated as verified. [1] [2]

Key Facts

Analysis table
Fact	Value
Affected artifacts	@injectivelabs/sdk-ts, @injectivelabs/utils, @injectivelabs/networks, @injectivelabs/ts-types, @injectivelabs/exceptions, @injectivelabs/wallet-base, @injectivelabs/wallet-core, @injectivelabs/wallet-cosmos, @injectivelabs/wallet-private-key, @injectivelabs/wallet-evm, @injectivelabs/wallet-trezor, @injectivelabs/wallet-cosmostation, @injectivelabs/wallet-ledger, @injectivelabs/wallet-wallet-connect, @injectivelabs/wallet-magic, @injectivelabs/wallet-strategy, @injectivelabs/wallet-turnkey, @injectivelabs/wallet-cosmos-strategy
Ecosystem	npm
Malicious versions	@injectivelabs/sdk-ts@1.20.21, @injectivelabs/utils@1.20.21, @injectivelabs/networks@1.20.21, @injectivelabs/ts-types@1.20.21, @injectivelabs/exceptions@1.20.21, @injectivelabs/wallet-base@1.20.21, @injectivelabs/wallet-core@1.20.21, @injectivelabs/wallet-cosmos@1.20.21, @injectivelabs/wallet-private-key@1.20.21, @injectivelabs/wallet-evm@1.20.21, @injectivelabs/wallet-trezor@1.20.21, @injectivelabs/wallet-cosmostation@1.20.21, @injectivelabs/wallet-ledger@1.20.21, @injectivelabs/wallet-wallet-connect@1.20.21, @injectivelabs/wallet-magic@1.20.21, @injectivelabs/wallet-strategy@1.20.21, @injectivelabs/wallet-turnkey@1.20.21, @injectivelabs/wallet-cosmos-strategy@1.20.21
Disclosure	2026-07-09
Verified recovery direction	all affected packages@1.20.23

Evidence Assessment

Analysis table
Assessment	Claim	Evidence
Confirmed	Listed package versions carried or transitively resolved malicious code.	Static package analysis and version comparison by the cited researchers. [1] [2]
Confirmed	Trigger: runtime calls to PrivateKey.fromMnemonic() or PrivateKey.fromHex().	Source-level or compiled-artifact analysis. [1] [2]
Confirmed	base64-encodes wallet recovery material and sends it in X-Request-Id on a disguised gRPC-Web POST.	Decompiled/static analysis and reported telemetry where available. [1] [2]
Unclear	Number of affected organizations or successful thefts.	Neither source establishes a verified victim count.

Impact Determination

Analysis table
Classification	Criteria	Required evidence	Action	Closure gate
Exposure	Malicious selector in a lockfile, cache, or inventory	Preserve dependency graph and cache metadata	Isolate affected workload and determine whether trigger ran	Every matching host classified
Likely execution	Install/load logs or files align with the trigger	Process, file, CI, application, and egress timeline	Rebuild and rotate reachable secrets	Negative rescan and completed rotations
Confirmed compromise	IOC egress, payload hash, or theft/abuse evidence	Proxy/EDR evidence with UTC timestamps	Incident response and downstream abuse review	Abuse review, recovery monitoring, and evidence sign-off

Minimum Evidence To Collect

Dependency evidence: preserve lockfiles, SBOMs, package-manager caches, and CI restore/install logs; they identify exact versions and resolve exposure classification.
Execution evidence: collect EDR process/file events and application or assembly-load logs around dependency use; they determine whether runtime calls to PrivateKey.fromMnemonic() or PrivateKey.fromHex() occurred.
Network evidence: retain DNS, proxy, firewall, and TLS metadata for testnet.archival.chain.grpc-web.injective.network; a matching outbound event materially raises confidence.
Identity evidence: export audit logs for identities holding Injective wallet private keys, mnemonic phrases, and funds controlled by those keys; these decide credential rotation scope and whether downstream abuse occurred.

Timeline

2026-07-09 (UTC; exact time varies by artifact): malicious publication/discovery activity documented by the cited researchers. [1] [2]
2026-07-09: public technical reporting and defensive guidance published. [1] [2]
Current registry removal status: unknown after this source-only review; validate through metadata-only registry queries before publication.

What Happened

The incident abused trusted package distribution or a deceptive package identity to deliver code that looked compatible with expected developer workflows. It then used runtime calls to PrivateKey.fromMnemonic() or PrivateKey.fromHex() to activate and base64-encodes wallet recovery material and sends it in X-Request-Id on a disguised gRPC-Web POST. [1] [2]

Initial Access

The affected artifacts were distributed through npm package channels. This folder does not infer an actor identity beyond source-supported account or publishing-path facts. [1] [2]

Execution Trigger

Runtime calls to privatekey.frommnemonic() or privatekey.fromhex(). [1] [2]

Payload Behavior

The observed payload base64-encodes wallet recovery material and sends it in X-Request-Id on a disguised gRPC-Web POST. [1] [2]

Credential or Data Collection

The defensible exposure set is Injective wallet private keys, mnemonic phrases, and funds controlled by those keys. Rotate only after preserving evidence and mapping which secrets were available to the affected process. [1] [2]

Defense Evasion

The source reporting describes deceptive naming, silent failure, obfuscation, or trigger placement intended to reduce discovery. Do not generalize beyond the specific files and selectors in this packet. [1] [2]

Exfiltration and Command and Control

Observed network selectors are testnet.archival.chain.grpc-web.injective.network. Human-readable prose is defanged where shown; raw values remain in iocs.json. [1] [2]

Affected Assets and Blast Radius

Analysis table
Asset	Exposure path	Priority
Developer workstations	dependency installed, imported, or loaded	High
CI/build runners	package restore plus secrets in job context	Critical
Production applications	runtime trigger or assembly use	Critical
Downstream identities	secrets reachable by affected process	Critical

Indicators of Compromise

Analysis table
Type	Values
Package versions	@injectivelabs/sdk-ts@1.20.21, @injectivelabs/utils@1.20.21, @injectivelabs/networks@1.20.21, @injectivelabs/ts-types@1.20.21, @injectivelabs/exceptions@1.20.21, @injectivelabs/wallet-base@1.20.21, @injectivelabs/wallet-core@1.20.21, @injectivelabs/wallet-cosmos@1.20.21, @injectivelabs/wallet-private-key@1.20.21, @injectivelabs/wallet-evm@1.20.21, @injectivelabs/wallet-trezor@1.20.21, @injectivelabs/wallet-cosmostation@1.20.21, @injectivelabs/wallet-ledger@1.20.21, @injectivelabs/wallet-wallet-connect@1.20.21, @injectivelabs/wallet-magic@1.20.21, @injectivelabs/wallet-strategy@1.20.21, @injectivelabs/wallet-turnkey@1.20.21, @injectivelabs/wallet-cosmos-strategy@1.20.21
Files	src/utils/key-derivation-telemetry.ts, dist/esm/accounts-jQ1GSgaW.js, dist/cjs/accounts-Cy0p4lLW.cjs
Domains (defanged)	testnet[.]archival[.]chain[.]grpc-web[.]injective[.]network
IPs (defanged)	None published
SHA-256	103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0, 9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9

Detection and Hunting

Run scripts/hunt.py opens in a new tab against exported lockfiles, SBOMs, restore/install logs, proxy/DNS logs, or file inventories. It answers whether exact package versions, file selectors, hashes, domains, or IPs are present. A match is a triage lead; package-only matches may be false positives from documentation or cleanly quarantined caches. Escalate by preserving the matching record and correlating it with process and identity audit logs.

Downstream Abuse Audits

Review source-control, registry, cloud, payment, wallet, and CI identity logs only where the affected process could access those services. Search from the earliest package acquisition through credential rotation for new tokens, unusual sessions, publishing, transaction changes, secret reads, and deployment activity. The reason is specific: the payload targeted Injective wallet private keys, mnemonic phrases, and funds controlled by those keys. [1] [2]

Remediation and Recovery Gates

Preserve lockfiles, caches, process/file telemetry, and egress evidence before cleanup.
Stop package execution and isolate hosts with runtime or egress evidence.
Remove the listed versions and invalidate internal caches.
Rotate Injective wallet private keys, mnemonic phrases, and funds controlled by those keys from a clean host, prioritizing secrets present during execution.
Rebuild likely or confirmed hosts from verified images rather than trusting package removal alone.
Apply the recovery direction: all affected packages@1.20.23.
Audit downstream identity and transaction activity from first exposure through rotation.
Rescan lockfiles, caches, files, and egress exports with the tested hunter.
Close only after every exposed host is classified, required rotations and abuse reviews are complete, and post-recovery monitoring is clean.

Open Questions

How many organizations actually executed the malicious code?
Is additional attacker infrastructure or campaign-linked packaging still active?
What is the current registry availability/deprecation status of every listed version?

Sources

https://socket.dev/blog/compromised-injective-sdk-npm-package opens in a new tab — Socket — primary technical research supporting package, behavior, timeline, and IOC claims; it does not prove the number of affected organizations.
https://www.stepsecurity.io/blog/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys opens in a new tab — StepSecurity — primary technical research supporting package, behavior, timeline, and IOC claims; it does not prove the number of affected organizations.

Timeline

Timeline
Date	Event	Description	Source

Invalid Date	Malicious publish time	Malicious publish time recorded for Injective Labs SDK npm compromise steals wallet keys and mnemonics.	StepSecurity
Jul 9, 2026	Discovery	Discovery recorded for Injective Labs SDK npm compromise steals wallet keys and mnemonics.	StepSecurity
Jul 9, 2026	Disclosure	Disclosure recorded for Injective Labs SDK npm compromise steals wallet keys and mnemonics.	StepSecurity
Invalid Date	Patch or fix	Patch or fix recorded for Injective Labs SDK npm compromise steals wallet keys and mnemonics.	StepSecurity
Jul 9, 2026	Injective Labs SDK npm compromise steals wallet keys and mnemonics	Unknown	StepSecurity
Jul 9, 2026	First seen	First seen recorded for Injective Labs SDK npm compromise steals wallet keys and mnemonics.	StepSecurity
Invalid Date	Removal	Removal recorded for Injective Labs SDK npm compromise steals wallet keys and mnemonics.	StepSecurity

Affected Software

Affected Software
Package	Ecosystem	Version Range	Status	Confidence	Source

@injectivelabs/wallet-cosmos-strategy	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/sdk-ts	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/utils	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/networks	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/ts-types	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/exceptions	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-base	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-core	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-cosmos	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-private-key	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-evm	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-trezor	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-cosmostation	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-ledger	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-wallet-connect	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-magic	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-strategy	npm	1.20.21	Malicious	90%	StepSecurity; Socket
@injectivelabs/wallet-turnkey	npm	1.20.21	Malicious	90%	StepSecurity; Socket

IOC Clipboard

7 IOCs

file_pathsrc/utils/key-derivation-telemetry.ts

domaintestnet.archival.chain.grpc-web.injective.network

file_pathdist/cjs/accounts-Cy0p4lLW.cjs

network_patterntestnet.archival.chain.grpc-web.injective.network

file_pathdist/esm/accounts-jQ1GSgaW.js

hash103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0

hash9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9

Tested Hunting Scripts

Tested Hunting Scripts
Title	Language	Description	Repository	Source
Injective Labs SDK npm compromise steals wallet keys and mnemonics evidence scope	Python	Do exported dependency, file, or network records contain incident-specific selectors?	scripts/hunt.py opens in a new tab	StepSecurity

Hunt Manifest: Injective Labs SDK npm compromise steals wallet keys and mnemonics evidence scope

Title: Injective Labs SDK npm compromise steals wallet keys and mnemonics evidence scope
Question: Do exported dependency, file, or network records contain incident-specific selectors?
Telemetry Family: Python
Repository: scripts/hunt.py

Show tested hunting scriptscripts/hunt.py

#!/usr/bin/env python3
"""Read-only IOC scanner for exported text/CSV/JSON evidence. Never installs packages."""
import argparse,json,re,sys
IOCS={'packages': ['@injectivelabs/sdk-ts', '@injectivelabs/utils', '@injectivelabs/networks', '@injectivelabs/ts-types', '@injectivelabs/exceptions', '@injectivelabs/wallet-base', '@injectivelabs/wallet-core', '@injectivelabs/wallet-cosmos', '@injectivelabs/wallet-private-key', '@injectivelabs/wallet-evm', '@injectivelabs/wallet-trezor', '@injectivelabs/wallet-cosmostation', '@injectivelabs/wallet-ledger', '@injectivelabs/wallet-wallet-connect', '@injectivelabs/wallet-magic', '@injectivelabs/wallet-strategy', '@injectivelabs/wallet-turnkey', '@injectivelabs/wallet-cosmos-strategy'], 'versions': ['@injectivelabs/sdk-ts@1.20.21', '@injectivelabs/utils@1.20.21', '@injectivelabs/networks@1.20.21', '@injectivelabs/ts-types@1.20.21', '@injectivelabs/exceptions@1.20.21', '@injectivelabs/wallet-base@1.20.21', '@injectivelabs/wallet-core@1.20.21', '@injectivelabs/wallet-cosmos@1.20.21', '@injectivelabs/wallet-private-key@1.20.21', '@injectivelabs/wallet-evm@1.20.21', '@injectivelabs/wallet-trezor@1.20.21', '@injectivelabs/wallet-cosmostation@1.20.21', '@injectivelabs/wallet-ledger@1.20.21', '@injectivelabs/wallet-wallet-connect@1.20.21', '@injectivelabs/wallet-magic@1.20.21', '@injectivelabs/wallet-strategy@1.20.21', '@injectivelabs/wallet-turnkey@1.20.21', '@injectivelabs/wallet-cosmos-strategy@1.20.21'], 'files': ['src/utils/key-derivation-telemetry.ts', 'dist/esm/accounts-jQ1GSgaW.js', 'dist/cjs/accounts-Cy0p4lLW.cjs'], 'domains': ['testnet.archival.chain.grpc-web.injective.network'], 'ips': [], 'hashes': ['103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0', '9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9']}
def scan(path):
 text=path.read_text(errors="replace").lower(); hits=[]
 for kind,vals in IOCS.items():
  for value in vals:
   if value.lower() in text: hits.append({"type":kind,"value":value,"path":str(path)})
 return hits
def main():
 from pathlib import Path
 ap=argparse.ArgumentParser(); ap.add_argument("paths",nargs="+"); ap.add_argument("--json",action="store_true"); a=ap.parse_args(); hits=[]
 for raw in a.paths:
  p=Path(raw)
  if p.is_file(): hits += scan(p)
  elif p.is_dir():
   for f in p.rglob("*"):
    if f.is_file(): hits += scan(f)
 if a.json: print(json.dumps({"hits":hits},indent=2))
 else:
  for h in hits: print(f"{h['type']}\t{h['value']}\t{h['path']}")
 return 2 if hits else 0
if __name__=="__main__": raise SystemExit(main())

Provenance & Sources

Provenance & Sources
Source	Type	Reliability	Claims	Evidence
StepSecurity	Security Researcher	95%	1	A compromised maintainer account pushed wallet-key exfiltration code through Injective’s trusted GitHub Actions publisher into 18 npm packages.
Socket	Vendor	95%	1	A compromised maintainer account pushed wallet-key exfiltration code through Injective’s trusted GitHub Actions publisher into 18 npm packages.