--- title: Compromised Injective SDK npm Package Exfiltrates Wallet... description: A malicious version of @injectivelabs/sdk-ts (1.20.21) was published to npm containing code that exfiltrates wallet private keys and mnemonic phrases via fake... canonical: https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Compromised Injective SDK npm Package Exfiltrates Wallet Key... | daily.dev og:description: A malicious version of @injectivelabs/sdk-ts (1.20.21) was published to npm containing code that exfiltrates wallet private keys and mnemonic phrases via fake... og:url: https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw og:image: https://api.daily.dev/og/posts/CBV0i2kIW.png og:image:alt: Compromised Injective SDK npm Package Exfiltrates Wallet Key... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Compromised Injective SDK npm Package Exfiltrates Wallet Key... **[Socket](https://daily.dev/sources/socketdev)** · 6 min read · 1 upvotes · 0 comments ## Summary A malicious version of @injectivelabs/sdk-ts (1.20.21) was published to npm containing code that exfiltrates wallet private keys and mnemonic phrases via fake telemetry. The compromise was introduced through a developer account with an established contribution history. The malicious code hooks the fromMnemonic and fromHex functions to silently POST base64-encoded sensitive data to a disguised Injective Labs infrastructure endpoint. The attack extended to 17 additional @injectivelabs scoped packages pinned to the malicious version, amplifying the blast radius beyond direct users. With ~50,000 weekly downloads, the impact is significant. The compromised version was deprecated but not removed from npm at time of writing. Developers should upgrade to 1.20.23, treat any exposed keys or mnemonics as compromised, move funds, rotate credentials, and audit transitive dependencies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is @injectivelabs/sdk-ts version 1.20.21 on npm safe to use? No, version 1.20.21 of @injectivelabs/sdk-ts is a compromised release that exfiltrates wallet private keys and mnemonic phrases. Malicious code hooks the fromMnemonic and fromHex functions, logging sensitive derivation data and sending it via a POST request to a disguised Injective Labs testnet endpoint. The clean, fixed version is 1.20.23. _Teams tracking Injective SDK security incidents can follow ongoing supply chain risk coverage on daily.dev._ ### How do I know if my project is affected by the malicious @injectivelabs npm packages? Check package.json for any @injectivelabs-scoped packages not pinned to a specific version, since they could resolve to the malicious 1.20.21 release, and also audit transitive dependencies, because 17 other @injectivelabs packages were published at version 1.20.21 with dependencies pinned directly to the compromised sdk-ts. Upgrade everything to 1.20.23 and rotate any exposed keys or mnemonics. _Developers auditing dependency trees for supply chain risk can keep up with cases like this via daily.dev._ ### How was the malicious version of @injectivelabs/sdk-ts published to npm? An attacker gained access to a legitimate contributor's GitHub account with an established commit history and used it to introduce malicious code, first testing access via a branch called test-backdoor-check on June 8, 2026, then publishing version 1.20.21 about three hours later. The true account owner detected and reverted the change within roughly 49 minutes, publishing a clean version, though compromised artifacts remained available afterward. _Understanding how maintainer accounts get hijacked helps developers evaluate open source dependency trust on daily.dev._ ## Similar posts on daily.dev - [Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry](https://daily.dev/posts/compromised-injectivelabs-sdk-ts-exfiltrates-wallet-keys-through-fake-telemetry-gg1twczdh) · Aikido Security · 0 upvotes · 0 comments - [Injective SDK on npm infected with cryptocurrency wallet stealer](https://daily.dev/posts/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer-2u95ebyn1) · BleepingComputer · 0 upvotes · 0 comments - [Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys](https://daily.dev/posts/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys-qvukjacsf) · StepSecurity · 0 upvotes · 0 comments - [5 Malicious npm Packages Typosquat Solana and Ethereum Libra...](https://daily.dev/posts/5-malicious-npm-packages-typosquat-solana-and-ethereum-libra--gayqpslsx) · Socket · 3 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Compromised Injective SDK npm Package Exfiltrates Wallet Key...","url":"https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw"},"datePublished":"2026-07-09T14:59:48.937Z","dateModified":"2026-09-14T06:11:23.121Z","description":"A malicious version of @injectivelabs/sdk-ts (1.20.21) was published to npm containing code that exfiltrates wallet private keys and mnemonic phrases via fake...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f2e5837f475d56158638b5961d4207f1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f2e5837f475d56158638b5961d4207f1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,crypto,malware,npm","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Compromised Injective SDK npm Package Exfiltrates Wallet Key..."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw#faq","mainEntity":[{"@type":"Question","name":"Is @injectivelabs/sdk-ts version 1.20.21 on npm safe to use?","acceptedAnswer":{"@type":"Answer","text":"No, version 1.20.21 of @injectivelabs/sdk-ts is a compromised release that exfiltrates wallet private keys and mnemonic phrases. Malicious code hooks the fromMnemonic and fromHex functions, logging sensitive derivation data and sending it via a POST request to a disguised Injective Labs testnet endpoint. The clean, fixed version is 1.20.23. Teams tracking Injective SDK security incidents can follow ongoing supply chain risk coverage on daily.dev."}},{"@type":"Question","name":"How do I know if my project is affected by the malicious @injectivelabs npm packages?","acceptedAnswer":{"@type":"Answer","text":"Check package.json for any @injectivelabs-scoped packages not pinned to a specific version, since they could resolve to the malicious 1.20.21 release, and also audit transitive dependencies, because 17 other @injectivelabs packages were published at version 1.20.21 with dependencies pinned directly to the compromised sdk-ts. Upgrade everything to 1.20.23 and rotate any exposed keys or mnemonics. Developers auditing dependency trees for supply chain risk can keep up with cases like this via daily.dev."}},{"@type":"Question","name":"How was the malicious version of @injectivelabs/sdk-ts published to npm?","acceptedAnswer":{"@type":"Answer","text":"An attacker gained access to a legitimate contributor's GitHub account with an established commit history and used it to introduce malicious code, first testing access via a branch called test-backdoor-check on June 8, 2026, then publishing version 1.20.21 about three hours later. The true account owner detected and reverted the change within roughly 49 minutes, publishing a clean version, though compromised artifacts remained available afterward. Understanding how maintainer accounts get hijacked helps developers evaluate open source dependency trust on daily.dev."}}]} ```