A critical security vulnerability has been discovered in a popular Node Package Manager (npm) package, allowing hackers to steal cryptocurrency wallet private keys and mnemonic seed phrases. The Injective SDK project’s GitHub repository was compromised, leading to the publication of a malicious package on npm that has already been downloaded over 50,000 times.
The affected package, @injectivelabs/sdk-ts version 1.20.21, is used by developers building applications on the Injective blockchain, including cryptocurrency wallets, trading bots, and decentralized exchanges. The package’s large user base and frequent updates made it an attractive target for attackers. Researchers at Socket, Ox Security, and StepSecurity detected the supply-chain attack, but not before the malicious version was downloaded 310 times.
The malware activates when developers use SDK functions that generate or import wallet keys, capturing the full mnemonic seed phrase and private key in the process. The stolen data is then encoded in base64 and sent via an HTTP POST request to an Injective Labs public infrastructure endpoint. The attackers may use this information to access, use, or transfer the victim’s digital assets.
The compromised package has 87 direct dependencies on npm, which had a cumulative download count of over 112,000. This means that even if developers who directly used the malicious package have transferred their cryptocurrency to new wallets and rotated all secrets in their environment, they may still be vulnerable due to transitive dependencies.
The attackers’ goal is to steal sensitive information related to cryptocurrency wallets, which can be used for malicious purposes such as porting victim’s wallets to their own devices. The discovery of this vulnerability highlights the importance of regularly updating packages and monitoring application security. Developers who suspect compromise should take immediate action by transferring their cryptocurrency to new wallets and rotating all secrets in their environment.
The incident also underscores the need for robust security measures, including regular testing and simulation exercises. By proactively identifying vulnerabilities and conducting breach and attack simulations, organizations can strengthen their defenses and reduce the likelihood of successful attacks. As we continue to rely on third-party packages and libraries, it is essential that developers prioritize application security and stay vigilant against potential threats.
In the aftermath of this incident, developers are reminded to exercise caution when using popular npm packages, especially those with a large user base and frequent updates. By being aware of potential vulnerabilities and taking proactive steps to secure their applications, we can mitigate the risks associated with supply-chain attacks and protect our digital assets from unauthorized access.
Source: Bleeping Computer — 2026-07-09