# Injective npm SDK backdoor exposed, 300+ downloads compromised

**Published:** 2026-07-18T01:09:47.806Z  
**Topic:** Injective  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/d86e9f92-fbb2-408e-a713-af717ba12f65

Hackers injected a backdoor into Injective’s TypeScript SDK (v1.20.21), stealing wallet keys from over 300 downloads; see how the supply‑chain breach unfolded

Injective’s popular TypeScript SDK (npm @injectivelabs/sdk‑ts) was compromised for under an hour on July 8‑9, 2026, exposing wallet mnemonics and private keys from roughly 300 downloads before a clean version (v1.20.23) was published [1].

| At a glance | |
|---|---|
| Package | @injectivelabs/sdk‑ts v1.20.21 |
| Weekly downloads | ~50,000 |
| Downloads of malicious version | >300 |
| Duration of malicious code | ~49 minutes |
| Catalyst | Supply‑chain attack via compromised maintainer account |

## How the attack unfolded  
Attackers gained write access to a trusted maintainer’s GitHub account and pushed a malicious commit directly to the master branch, bypassing pull‑request review [2]. The change added a 79‑line file called `key‑derivation‑telemetry.ts`, which silently called `trackKeyDerivation` from the SDK’s wallet‑creation methods `PrivateKey.fromMnemonic` and `PrivateKey.fromHex`. Each call captured the full BIP‑39 seed phrase or raw private key, batched the data, base64‑encoded it, and exfiltrated it to an obfuscated endpoint on Injective’s testnet infrastructure [2]. Because the backdoor lived in the SDK itself, any of the 18 related packages that pinned the exact version also pulled in the compromised code, extending the risk transitively [2].

## Scope and response  
The malicious release (v1.20.21) was live for roughly 49 minutes before the maintainer reverted the commit and a clean version (v1.20.23) was republished [2]. Socket detected the breach and warned developers to treat any wallet credentials processed by the compromised releases as fully exposed, recommending immediate upgrades and dependency‑chain reviews [1]. While the SDK sees about 50 k weekly downloads, the specific malicious version was downloaded more than 300 times before removal, and the compromised package remains listed as a deprecated download on npm [1][3].

## Impact on the Injective ecosystem  
The incident highlights the high‑value target that developer tooling represents in the crypto stack. Even a brief supply‑chain breach can expose sensitive keys for thousands of users, given the SDK’s role in building wallets, DEX front‑ends, and trading bots. Although no confirmed thefts have been reported, the potential for downstream loss remains significant, especially for projects that cached the tainted package or built production binaries during the window [1].

## What to watch
- **Version 1.20.23 adoption** – monitor npm download trends to ensure the clean SDK supersedes the compromised version.  
- **Dependency chains** – watch for any packages that still pin the exact 1.20.21 version, which could re‑introduce the backdoor.  
- **On‑chain activity** – spikes in address creation or fund movements on the Injective network may indicate exploitation of exposed keys.

The breach underscores the fragility of open‑source supply chains in Web3, where a single compromised maintainer can jeopardize the security of an entire ecosystem. Ongoing vigilance of package versions and rapid response protocols will be crucial to prevent similar incidents.

## Sources
1. Crypto Briefing — [Hackers target Injective developers with malicious SDK](https://cryptobriefing.com/injective-npm-backdoor-wallet-key-attack/)
2. Stepsecurity — [Injective npm Supply Chain Attack: 18 Packages... - StepSecurity](https://www.stepsecurity.io/blog/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys)
3. Cointelegraph — [Injective NPM Package Hacked to Steal Crypto Wallet Keys](https://cointelegraph.com/news/hackers-compromise-injective-npm-package-with-malware-to-steal-wallet-keys)

---
Cite as: TrendWatcher, "Injective npm SDK backdoor exposed, 300+ downloads compromised", https://www.trendwatcher.in/article/d86e9f92-fbb2-408e-a713-af717ba12f65