A malicious package on the Node Package Manager (npm) has compromised thousands of developer systems, targeting cryptocurrency wallets and stealing private keys and mnemonic seed phrases. The Injective Labs SDK project’s GitHub repository was hacked, allowing attackers to publish a malicious version of the @injectivelabs/sdk-ts npm package. This supply-chain attack highlights the importance of securing software development kits (SDKs) and monitoring dependencies.
The compromised package, version 1.20.21, had 50,000 weekly downloads on npm and is used by developers building cryptocurrency wallets, trading bots, decentralized exchanges, DeFi applications, and payment tools. The attackers exploited a GitHub account belonging to a legitimate project contributor, making suspicious commits on June 8 and publishing the malicious package shortly after. The owner of the compromised account detected the issue within minutes, reverted the changes, and published a clean release, version 1.20.23.
However, developer systems that fetched the malicious packages via an update or used them were likely compromised. The malicious version of the package was downloaded 310 times before it was deprecated, not removed, and the malicious GitHub release artifacts are still available. Furthermore, the package has 87 direct dependencies on npm, which likely have additional transitive dependencies. A report from Ox Security warns that these dependent packages had a cumulative download count of over 112,000.
The malware activates when developers use SDK functions that generate or import wallet keys, rather than upon installation. Once those functions are called, the malware captures the full mnemonic seed phrase and private key and encodes the data in base64. All the information is exfiltrated via an HTTP POST request to an Injective Labs public infrastructure endpoint to make the traffic appear legitimate. The attackers may then use the mnemonic or private key to port the victim’s wallets to their own devices and access, use, or transfer their digital assets.
Developers who suspect compromise should take immediate action by transferring their cryptocurrency to new wallets and rotating all secrets in their environment. This attack serves as a reminder of the importance of securing software development kits (SDKs) and monitoring dependencies. By regularly updating packages and conducting security audits, developers can reduce the risk of supply-chain attacks like this one.
In light of this incident, it’s essential for developers to implement robust security measures, such as testing every layer before attackers do. Security teams should also prioritize regular breach and attack simulation tests to identify vulnerabilities and improve detection capabilities.
Source: Bleeping Computer — 2026-07-09