--- title: Injective npm supply chain attack hits 50k weekly... description: Attackers compromised a trusted maintainer's GitHub account to poison @injectivelabs/sdk-ts v1.20.21, silently exfiltrating crypto wallet seed phrases and... canonical: https://daily.dev/posts/injective-npm-supply-chain-attack-hits-50k-weekly-downloads-ghostapproval-patches-still-incomplete-h1lowxym4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Injective npm supply chain attack hits 50k weekly downloads, GhostApproval patches still incomplete | daily.dev og:description: Attackers compromised a trusted maintainer's GitHub account to poison @injectivelabs/sdk-ts v1.20.21, silently exfiltrating crypto wallet seed phrases and... og:url: https://daily.dev/posts/injective-npm-supply-chain-attack-hits-50k-weekly-downloads-ghostapproval-patches-still-incomplete-h1lowxym4 og:image: https://api.daily.dev/og/posts/h1lOwXym4.png og:image:alt: Injective npm supply chain attack hits 50k weekly downloads, GhostApproval patches still incomplete og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Injective npm supply chain attack hits 50k weekly downloads, GhostApproval patches still incomplete **[Security Digest](https://daily.dev/sources/security_digest)** · 5 min read · 3 upvotes · 3 comments ## Summary Attackers compromised a trusted maintainer's GitHub account to poison @injectivelabs/sdk-ts v1.20.21, silently exfiltrating crypto wallet seed phrases and private keys via fake telemetry to Injective's own infrastructure endpoints. The malicious version propagated to 18 packages within minutes and was live for roughly 49 minutes before being reverted, but was downloaded 310 times. The RoguePlanet zero-day in Windows Defender (CVE-2026-50656) is now patched via Malware Protection Engine 1.1.26060.3008, though a researcher found the patch itself may introduce a disk-exhaustion side effect. GhostApproval coverage continues to expand, with Augment and Windsurf still working on fixes. ## Content **TLDR:** Attackers compromised a trusted maintainer's GitHub account to poison @injectivelabs/sdk-ts v1.20.21, silently exfiltrating crypto wallet seed phrases and private keys via fake telemetry to Injective's own infrastructure endpoints. The malicious version propagated to 18 packages within minutes and was live for roughly 49 minutes before being reverted, but was downloaded 310 times. The RoguePlanet zero-day in Windows Defender (CVE-2026-50656) is now patched via Malware Protection Engine 1.1.26060.3008, though a researcher found the patch itself may introduce a disk-exhaustion side effect. GhostApproval coverage continues to expand, with Augment and Windsurf still working on fixes. --- ## Injective Labs npm supply chain attack: wallet keys exfiltrated via fake telemetry in 18 packages On July 8, attackers compromised a GitHub account belonging to a legitimate Injective Labs contributor and published @injectivelabs/sdk-ts v1.20.21 with a backdoor that hooks PrivateKey.fromMnemonic and PrivateKey.fromHex, base64-encoding seed phrases and private keys into an X-Request-Id header disguised as gRPC-web traffic to a subdomain mimicking Injective's own infrastructure. The payload propagated automatically to 17 additional @injectivelabs scoped packages via monorepo publishing within minutes. The malicious version was live for roughly 49 minutes, downloaded 310 times, and affects a package with 50,000 weekly downloads. Anyone who installed v1.20.21 during that window should treat all wallet secrets as compromised, move funds immediately, upgrade to v1.20.23, and audit transitive dependencies. [Read more](https://daily.dev/feed-by-ids?id=2u95Ebyn1&id=QVUKJAcsF&id=GG1TWczDH&id=CBV0i2kIW) ## RoguePlanet (CVE-2026-50656) patched in Windows Defender, but the fix may introduce disk exhaustion Microsoft shipped an out-of-band patch for CVE-2026-50656, a CVSS 7.8 elevation-of-privilege zero-day in the Windows Defender Malware Protection Engine that lets a local attacker escalate to SYSTEM via a race condition. The fix is delivered automatically via Malware Protection Engine 1.1.26060.3008. However, researcher NightmareEclipse found that the defense-in-depth mitigations added to mpengine.dll introduce an 8-byte data leak on file open, and new SpyNet functionality bypasses Defender's normal file-size limits when caching Zone.Identifier ADS files, meaning attackers could potentially exhaust all available disk space. Verify your engine version is at 1.1.26060.3008 or later and monitor for privilege escalation indicators regardless. [Read more](https://daily.dev/feed-by-ids?id=e3Ekf8DDo&id=Idbg5Jdx1&id=dm8N7bX1X&id=dDU6YtwLk) ## GhostApproval symlink attack: category-level design flaw, Augment and Windsurf fixes still in progress Wiz's GhostApproval report continues to generate coverage, with additional analysis confirming the attack chains three weaknesses: prompt injection via README, symlink following without path resolution, and UI misrepresentation in approval dialogs that hides the real target path. All six tested tools — Claude Code, Amazon Q Developer, Google Antigravity, Augment, Cursor, and Windsurf — were affected. AWS, Cursor, and Google have patched; Augment and Windsurf have fixes in progress; Anthropic shipped a symlink warning after initially rejecting the report. The fix is well understood: resolve every path to its canonical form before opening it, enforce workspace boundaries with something like Linux's openat2() with RESOLVE_BENEATH, and always show the resolved path in confirmation dialogs. Audit any fresh clone with `find . -type l` before pointing an agent at it. [Read more](https://daily.dev/feed-by-ids?id=kihdn3zbN&id=LpPpux8Vz&id=P5K7J9cPU) ## LSHIY password spray: 81 million login attempts bypassed MFA via ROPC flow misconfiguration Huntress researchers detail an ongoing automated password spray from IPv6 ranges controlled by LSHIY LLC (AS32167) that made over 81 million login attempts between June 12–26, compromising 78 Microsoft accounts across 64 organizations. The attack exploited the deprecated OAuth ROPC flow, which bypasses MFA prompts entirely. Many affected organizations had Conditional Access Policies in place, but gaps — MFA scoped to specific apps rather than all cloud apps, policies in report-only mode, incorrect trusted location labeling — let attackers through. The fix is straightforward: require MFA for All Users, All Cloud Apps, and All Client App types unconditionally, and block legacy auth flows including ROPC. [Read more](https://daily.dev/feed-by-ids?id=PYHMqiMyh&id=BdoqVEIQI) --- ## Also notable - **PolinRider/Lazarus supply chain campaign expands to Go modules and Packagist via GitHub account takeovers:** DPRK-linked PolinRider has compromised over 80 Go modules and 10 Packagist packages by taking over legitimate GitHub accounts — no separate registry credentials needed, since Go and Packagist resolve directly from Git repos — injecting obfuscated JS loaders that fetch Beavertail and InvisibleFerret components via TRON/Aptos/BNB blockchain dead-drops. [Read more](https://daily.dev/posts/dakvhuonQ) - **Scattered Spider members plead guilty day one of UK trial, linked to $115M in ransom across 120 intrusions:** Thalha Jubair and Owen Flowers pleaded guilty on the first day of their UK trial for the August 2024 Transport for London attack; Jubair faces a separate US indictment alleging 120 network intrusions across 47 entities with at least $115 million paid in ransom, with sentencing scheduled July 15. [Read more](https://daily.dev/posts/eSWB9YO0B) - **OpenSSH 10.4 adds experimental ML-DSA 44 + Ed25519 composite post-quantum signature scheme:** OpenSSH 10.4 ships experimental support for a composite post-quantum signature scheme combining ML-DSA 44 and Ed25519 per an IETF draft, and will now hard-fail on Linux systems lacking SECCOMP or NO_NEW_PRIVS rather than logging and continuing. [Read more](https://daily.dev/posts/HVdxiB33z) - **Linux kernel CVE-2026-53362 allows container escape and root access, patched in seven stable releases:** Seven stable kernels (7.1.3 through 5.10.260) were released including a fix for CVE-2026-53362, an IPv6 vulnerability introduced in kernel 6.0 that can allow container escape and root access, alongside CVE-2026-53359, a use-after-free in KVM dating to 2.6.36. [Read more](https://daily.dev/posts/sZ8YgAzlD) - **AssuranceAmerica breach: 6.9 million driver's license numbers stolen via single phishing-compromised employee:** Insurance provider AssuranceAmerica disclosed a breach affecting up to 6.9 million customers — names, driver's license numbers, auto insurance policy details, and claims data — after attackers gained access March 16 via a single employee's phished credentials, with the investigation concluding June 15. [Read more](https://daily.dev/feed-by-ids?id=uWv5oCzRN&id=YfPpZGGBJ) ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > Worth noting this is exactly the class of attack npm v12's default-off install scripts won't stop — the payload fired on wallet create/load at runtime, not in a postinstall hook, so lifecycle-script blocking sails right past it. The load-bearing defenses here are publish provenance (npm trusted-publishing/attestations) and simply not auto-adopting a release the hour it drops. Auto-publish fanning the compromised version out to 18 packages in minutes is the real lesson: no human in the release loop meant instant blast radius. **@erikandersoon** · 0 upvotes > The real takeaway: a single compromised maintainer account + auto-publish = instant blast radius across 18 packages, and since the payload fired at runtime (not install time), npm v12's postinstall blocking wouldn't have stopped it. Until npm's trust model evolves, the only defense is don't auto-adopt releases the hour they drop. ## Similar posts on daily.dev - [Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys](https://daily.dev/posts/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys-qvukjacsf) · StepSecurity · 0 upvotes · 0 comments - [Four More Supply Chain Attacks Hit npm and PyPI](https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp) · GitGuardian · 7 upvotes · 0 comments - [Injective SDK on npm infected with cryptocurrency wallet stealer](https://daily.dev/posts/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer-2u95ebyn1) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/injective-npm-supply-chain-attack-hits-50k-weekly-downloads-ghostapproval-patches-still-incomplete-h1lowxym4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/injective-npm-supply-chain-attack-hits-50k-weekly-downloads-ghostapproval-patches-still-incomplete-h1lowxym4","headline":"Injective npm supply chain attack hits 50k weekly downloads, GhostApproval patches still incomplete","text":"Attackers compromised a trusted maintainer's GitHub account to poison @injectivelabs/sdk-ts v1.20.21, silently exfiltrating crypto wallet seed phrases and private keys via fake telemetry to Injective's own infrastructure endpoints. The malicious version propagated to 18 packages within minutes and was live for roughly 49 minutes before being reverted, but was downloaded 310 times. The RoguePlanet zero-day in Windows Defender (CVE-2026-50656) is now patched via Malware Protection Engine 1.1.26060.3008, though a researcher found the patch itself may introduce a disk-exhaustion side effect. GhostApproval coverage continues to expand, with Augment and Windsurf still working on fixes.","url":"https://daily.dev/posts/injective-npm-supply-chain-attack-hits-50k-weekly-downloads-ghostapproval-patches-still-incomplete-h1lowxym4","datePublished":"2026-07-10T04:19:03.000Z","dateModified":"2026-09-13T21:06:24.990Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"comment":[{"@type":"Comment","text":"Worth noting this is exactly the class of attack npm v12’s default-off install scripts won’t stop — the payload fired on wallet create/load at runtime, not in a postinstall hook, so lifecycle-script blocking sails right past it. The load-bearing defenses here are publish provenance (npm trusted-publishing/attestations) and simply not auto-adopting a release the hour it drops. Auto-publish fanning the compromised version out to 18 packages in minutes is the real lesson: no human in the release loop meant instant blast radius.","datePublished":"2026-07-11T18:07:29.098Z","url":"https://daily.dev/posts/h1lOwXym4#c-G56HlJfeQ","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}},{"@type":"Comment","text":"The real takeaway: a single compromised maintainer account + auto-publish = instant blast radius across 18 packages, and since the payload fired at runtime (not install time), npm v12’s postinstall blocking wouldn’t have stopped it. Until npm’s trust model evolves, the only defense is don’t auto-adopt releases the hour they drop.","datePublished":"2026-07-11T22:59:28.900Z","dateModified":"2026-07-11T23:00:39.282Z","url":"https://daily.dev/posts/h1lOwXym4#c-OxRqmekfT","author":{"@type":"Person","name":"Erik Andersoon","url":"https://daily.dev/erikandersoon","image":"https://lh3.googleusercontent.com/a/ACg8ocIjscYXslkLRHxEihtWWVgTFELNg4TVNJzpD0qugegOqLsZAw=s96-c"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"Injective npm supply chain attack hits 50k weekly downloads, GhostApproval patches still incomplete"}]} ```