Recent reports have surfaced detailing a significant supply chain attack targeting the Injective Labs SDK project on GitHub. Threat actors successfully compromised a developer's GitHub account and subsequently pushed a malicious package to the npm registry, leading to the theft of cryptocurrency wallet private keys and mnemonic seed phrases. This incident, reported on July 10, 2026, highlights the persistent risks within the software supply chain.

Chronology of the Attack

The malicious version of the package, identified as `@injectivelabs/sdk-ts@1.20.21`, was released on July 8, 2026. The compromise began with threat actors gaining unauthorized access to a GitHub account belonging to an established developer with a history of contributions to the Injective Labs SDK repository. Leveraging this access, they injected malicious functionality into the project's official GitHub repository through commits made under the trusted maintainer's identity. This allowed the malicious package to be published via the repository's trusted-publisher (OIDC) pipeline to the npm registry.

Impact and Mechanism

The core of the attack involved embedding a "fake telemetry functionality" within the `1.20.21` version of the package. This disguised malicious code was designed to exfiltrate sensitive data from cryptocurrency wallets. Specifically, whenever a legitimate user created or used logic that read mnemonic phrases – which are essentially master keys for crypto wallets – the malware would intercept and send this crucial information to a remote server controlled by the attackers. Parameters passed to this function included a hard-coded marker describing the method used to generate the private key and the sensitive information itself, allowing the threat actor to regenerate the private key.

While the malicious version has since been deprecated on the npm registry, the release artifacts remain available for download from GitHub, posing an ongoing risk to unsuspecting users who might still access older versions. The software supply chain security firm Socket detailed how the malicious logic was added to a cryptocurrency wallet package.

Protection and Remediation

Users who may have installed the compromised `@injectivelabs/sdk-ts@1.20.21` package are strongly advised to take immediate action. The primary recommendation is to update to the newly published, clean version of the package (version `1.20.23` or later).

Crucially, any private keys or mnemonic phrases that were passed through or generated by the compromised package should be considered fully compromised. Users must rotate these credentials immediately by transferring assets to a new, secure wallet and generating new private keys and seed phrases. Additionally, it is vital to check for any transitive dependencies that might have pulled in the malicious version of the package.

Developers and organizations should reinforce their software supply chain security practices, including implementing stricter access controls for developer accounts, mandating multi-factor authentication (MFA) for all repository access, and thoroughly reviewing code changes, especially those from external contributors or automated pipelines. Regular audits of dependencies and their versions are also essential to detect and mitigate such supply chain attacks promptly.