Security specialists from Socket have identified a critical incident in the Injective ecosystem. The malicious Injective SDK package version 1.20.21, hosted in the npm registry, was compromised. This release actively intercepted seed phrases and private keys of user wallets, sending them to attackers.
The incident resulted from a hack of a GitHub account belonging to one of the project's developers. According to my analysis, suspicious commits were made on June 8, 2026. The malicious code replaced standard key derivation functions, storing confidential data and transmitting it via fake telemetry to an address disguised as an official Injective server. This makes the attack particularly dangerous, as it targeted the most sensitive element of any crypto wallet—its private keys.
It is important to note that Socket also discovered version 1.20.21 in 17 other packages from the Injective Labs namespace on npm. This means the threat affected not only those who directly installed the SDK but also users whose projects indirectly depended on these libraries. Estimates suggest the malicious version was downloaded at least 300 times, indicating a potentially wide range of victims.
Injective CEO Eric Chen confirmed that the issue has been resolved and the compromised versions have been marked as deprecated. He also stated that funds on the Injective network are not at risk. As of now, there are no confirmed cases of fund theft, but I strongly recommend considering all keys and seed phrases that passed through the affected packages as compromised. Immediately create new wallets and transfer assets.
Expert Analysis
This incident is yet another reminder that wallet compromise remains the most costly attack vector in the crypto industry. According to CertiK, losses from such attacks totaled $444.5 million across 33 incidents in the first half of 2026 alone. The attack on the Injective SDK, despite its rapid resolution, highlights the vulnerability of the supply chain in the decentralized ecosystem. Developers and users must implement multi-factor authentication and thoroughly vet all dependencies, especially when it comes to key security.