Experts from the Socket security platform have identified a critical incident in the Injective ecosystem. A malicious version of the official Injective SDK npm package (1.20.21) was compromised and actively used to intercept sensitive user data, including seed phrases and private keys from wallets.
Compromise Details
The root of the problem is the hacking of a GitHub account belonging to one of the project's developers. The first suspicious commits were recorded on June 8, 2026. The malicious code replaced standard key derivation functions, silently saving seed phrases and private keys. This data was then sent via fake telemetry to a remote server, which was skillfully disguised as official Injective infrastructure.
Scale of Distribution
The most alarming aspect is that the malicious version was found not only in the SDK itself but also in 17 other packages from the Injective Labs namespace on npm. This means that even users who did not install the SDK directly but used dependent libraries were at risk. According to monitoring data, the compromised version was downloaded at least 300 times.
Response and Recommendations
Injective CEO Eric Chen confirmed that the issue has already been resolved, and all affected versions have been marked as deprecated in the npm registry. He also emphasized that funds on the Injective mainnet are not at risk, although there are currently no official reports of confirmed thefts. Nevertheless, Socket strongly recommends considering any keys and seed phrases that may have been used through these packages as compromised and immediately replacing them.
Expert opinion. This incident is another reminder that supply chain attacks are becoming the dominant threat vector in the crypto industry. The hacking of a single developer account can jeopardize hundreds of users, and as CertiK data for the first half of 2026 shows, wallet compromises have already cost the industry $444.5 million. Developers need to implement multi-factor authentication and strict code auditing before publishing, while users should always verify the hashes and signatures of installed packages.