<p>Malicious version of Injective SDK in npm: stealing keys and seed phrases through a compromised package</p>

Security experts from Socket have identified a serious incident involving the compromise of the Injective SDK package in the npm registry. Version 1.20.21 of this package contained malicious code that intercepted seed phrases and private keys of user wallets.

The root of the problem is the hacking of a GitHub account belonging to one of the project's developers. According to my analysis, the first suspicious commits were recorded on June 8, 2026. The attackers injected modified key derivation functions that, when generating or importing wallets, saved confidential data and then sent it via fake telemetry to a server disguised as the official Injective infrastructure.

Of particular danger is that the malicious version 1.20.21 was also found in 17 packages from the Injective Labs namespace on npm. This means the attack could have affected even those users who did not directly install the SDK but used dependent libraries.

According to Socket estimates, the malicious package was downloaded at least 300 times. As of the publication of the analysis, the attack could not be fully contained. Researchers strongly recommend considering any keys and seed phrases that may have been used through the affected packages as compromised.

Injective CEO Eric Chen confirmed that the issue has been resolved and the affected versions on npm have been marked as deprecated. He also stated that funds on the mainnet are not at risk. However, no confirmed cases of fund theft have been reported yet.

This incident highlights the critical importance of supply chain security in the Web3 ecosystem. According to CertiK, in the first half of 2026, wallet compromises became the most costly attack vector, resulting in $444.5 million in losses across 33 incidents. The situation with the Injective SDK is another link in this alarming trend.

My comment: This case underscores the vulnerability of decentralized projects to infrastructure-level attacks. Even in the absence of direct financial losses, key compromise creates long-term risks for users. Developers need to implement multi-factor account protection and automatic dependency scanning for anomalies.