Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Summary: Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious npm package, @injectivelabs/sdk-ts@1.20.21, released July 8, 2026, that stole cryptocurrency wallet private keys and mnemonic seed phrases. The malicious code was introduced through commits by a GitHub account with an established contribution history, pushed under the identity of an existing trusted maintainer ("thomasRalee") via the repository's trusted-publisher (OIDC) pipeline, and version 1.20.21 was also published across 17 additional @injectivelabs scoped packages that pinned the malicious SDK version.
Why it matters: The poisoned package disguised key-stealing as a "trackKeyDerivation()" telemetry function, avoiding lifecycle scripts so it stayed quiet during installation and only fired when a developer generated a private key - and the captured material is enough for the attacker to regenerate that key. Anyone who passed a private key or mnemonic through the package should treat it as compromised and rotate it, and the release artifacts were still downloadable from GitHub even after the npm version was deprecated.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026