Someone compromised the Injective Labs GitHub repo and pushed a malicious npm package that steals cryptocurrency wallet private keys and seed phrases.
Security firms Socket, Ox Security, and StepSecurity spotted the attack in version 1.20.21 of @injectivelabs/sdk-ts — a TypeScript SDK for building on the Injective blockchain. The package gets about 50,000 weekly downloads and is used in wallets, trading bots, DeFi apps, and payment tools.
The attacker took over a legitimate contributor’s GitHub account and made the first suspicious commits on June 8. They published version 1.20.21 along with poisoned versions of 17 other related packages. The real account owner caught it within minutes, reverted everything, and pushed a clean 1.20.23 release.
But here’s the problem: the malicious package was downloaded 310 times before it got deprecated (not removed). GitHub release artifacts are still out there. And that SDK package has 87 direct npm dependencies — meaning the blast radius is probably bigger than those 310 downloads suggest.
The malware doesn’t activate on install. It waits until a developer uses SDK functions to generate or import wallet keys. Then it grabs the full mnemonic seed phrase and private key, base64-encodes them, and sends them via HTTP POST to an Injective Labs public endpoint — making the traffic look normal.
If you downloaded that malicious version, move your crypto to new wallets and rotate every secret in your environment. Don’t wait.
