Here’s a fresh reminder that crypto security isn’t just about smart contracts. Sometimes the attack comes through the tools developers use to build them.
Socket Security found that a popular npm package called @injectivelabs/sdk-ts — used to build on the Injective blockchain — was maliciously modified. The compromised version, 1.20.21, secretly hooked into wallet key-derivation functions. Every time a developer’s app generated a wallet key or seed phrase, the malware quietly copied it and sent it to a fake telemetry server.
The package gets about 50,000 weekly downloads. That makes this a big deal for anyone building Injective wallets or dApps.
How’d it happen? A compromised GitHub account. Suspicious commits started June 8. The bad code was also pinned across 17 other packages in the Injective Labs npm scope, so even developers who didn’t directly install the SDK could have been exposed.
Injective CEO Eric Chen said the issue is fixed and the affected versions are deprecated. The malware was downloaded about 310 times. Socket says any keys or seed phrases that passed through these packages should be treated as compromised.
This isn’t an isolated incident. Supply chain attacks on crypto dev tools are on the rise. In March, Axios npm releases got hit. In May, researchers found the TrapDoor malware campaign targeting crypto and DeFi developers. The Security Alliance (SEAL) noted in its Q2 threat report that attackers are increasingly using platforms like GitHub and npm to push malicious code. Sometimes they even compromise a company’s own repos and turn them into distribution channels.
Bottom line: if you’re a developer working with Injective tooling, rotate any keys that touched the affected package versions. Assume nothing.
