Overview
- The Injective Labs TypeScript SDK was backdoored on July 8 when a hijacked maintainer account published @injectivelabs/sdk-ts version 1.20.21 that captured wallet mnemonics and private keys during runtime.
- The malicious code targeted the SDK function that converts mnemonics to private keys and encoded stolen secrets into HTTP requests disguised as telemetry so the exfiltration looked legitimate.
- Researchers at Socket, StepSecurity and Ox Security found the tainted release propagated across roughly 17–18 Injective-scoped packages and was downloaded about 300 times before maintainers deprecated it.
- Injective maintainers reverted the commits, revoked the compromised access and published a clean release (1.20.23), but security teams warn cached packages, pinned dependencies and CI/CD pipelines may still run the poisoned code.
- Security firms recommend treating any wallets used with the affected versions as compromised, rotating keys and secrets, auditing lockfiles and caches, enforcing MFA and mandatory code review for publishers, and using runtime-behavior detectors to prevent similar supply-chain attacks.