Security experts from Socket have identified a serious threat to users of the Injective ecosystem. A malicious version of the Injective SDK npm package — 1.20.21 — was compromised and actively intercepted seed phrases and private keys of wallets. This is a classic example of a supply chain attack, where attackers inject malicious code into legitimate developer tools.
Incident Details
The root of the problem is a compromise of an Injective developer's GitHub account. The first suspicious commits appeared on June 8, 2026. The attacker replaced key derivation functions in the SDK: instead of standard address generation, the malicious code saved private keys and seed phrases, then sent them via fake telemetry to a server disguised as the official Injective server.
Of particular danger is the fact that Socket also recorded version 1.20.21 in 17 other packages from the Injective Labs namespace in npm. This means that even users who did not install the SDK directly but used dependent libraries were affected. The malicious version was downloaded at least 300 times, indicating the real scale of potential damage.
Response and Recommendations
Injective CEO Eric Chen confirmed that the issue has been resolved and the affected versions have been marked as deprecated in npm. He assured that funds directly on the Injective network are not at risk, and there have been no confirmed cases of fund theft so far. However, Socket recommends considering any keys and seed phrases that may have been used through these packages as compromised. The attack could not be fully localized at the time of analysis, leaving the question of additional vulnerabilities open.
This incident is another reminder that wallet compromise remains one of the most expensive attack vectors. According to CertiK, losses from such incidents in the first half of 2026 amounted to $444.5 million across 33 cases. In this case, the attack targeted not the protocol but developer tools, making it particularly insidious.
Expert opinion: Supply chain attacks in the crypto industry are becoming increasingly sophisticated. Even if you do not use the SDK directly, dependent packages can act as a "Trojan horse." I recommend that all developers and Injective users immediately check their npm package versions, revoke any keys that may have been compromised, and strengthen monitoring of GitHub accounts. This is not a one-time threat — it is a systemic security issue requiring a proactive approach.