An incident occurred in the Injective ecosystem involving the compromise of the official SDK package. Security specialists from Socket identified a malicious version of the Injective SDK npm — 1.20.21. This release was compromised and specifically intercepted seed phrases and private keys of user wallets.
The root of the problem lies in the hacking of a GitHub account belonging to one of the developers. Suspicious code changes were made on June 8, 2026. The attackers modified key derivation functions, allowing the malware to copy private data and send it to a fake server disguised as official Injective telemetry.
Of particular concern is that the compromised version was found not only in the main package but also in 17 other packages from the Injective Labs namespace on npm. This means that even users who did not directly install the SDK but used libraries dependent on it could have been affected.
According to the investigation, the malicious version was downloaded at least 300 times. The attack could not be fully contained at the time of the analysis publication. Specialists strongly recommend considering any keys and seed phrases that may have been used during the period of interaction with the affected packages as compromised.
Injective CEO Eric Chen confirmed that the issue has been resolved and the damaged versions on npm have been marked as deprecated. He assured that funds on the network are not at risk, and no confirmed cases of fund theft have been reported so far.
Analytical Commentary: This incident is yet another reminder that even official repositories and SDKs do not guarantee absolute security. Compromising developer accounts remains one of the most effective and costly attack vectors. According to CertiK, losses from such incidents exceeded $444 million in the first half of 2026. Users should immediately rotate their keys and seed phrases if they interacted with the affected versions.