Researchers report that unknown attackers compromise the Injective Labs SDK project’s GitHub repository and publish a malicious package on the npm registry. Multiple outlets describe the malware as targeting developers and applications that use Injective wallet workflows. The compromised npm release includes code designed to steal cryptocurrency wallet private keys and mnemonic seed phrases, which can enable unauthorized access to users’ funds.
One report says the attackers used a backdoor approach to affect the package and that the malicious functionality is disguised as legitimate features, including a fake telemetry component. The affected package version is reported as @injectivelabs/sdk-ts@1.20.21. After publication, the malicious package is intended to exfiltrate sensitive wallet data when it is used by downstream applications.
The incident underscores supply-chain risk in JavaScript package ecosystems, particularly when a project’s source repository is compromised and trusted packages are published without authorization. The reports emphasize impact for developers and services integrating the SDK, and they focus on the unauthorized access pathway through npm rather than a direct breach of end-user devices.
