Injective Labs GitHub Breach: A Stealthy Threat to Crypto Wallets Unveiled
In a significant security incident shaking the cryptocurrency development landscape, unknown threat actors successfully compromised the GitHub repository of the Injective Labs SDK project. This breach was then exploited to publish a highly malicious package on the npm registry, specifically engineered to steal cryptocurrency wallet private keys and mnemonic seed phrases from unsuspecting developers and their users.
The Anatomy of the Attack: Fake Telemetry and Key Exfiltration
The compromised version, identified as @injectivelabs/sdk-ts@1.20.21, was reportedly released on July 8, 2026 (Note: This date appears to be a future date in the original report; we are treating it as a past event for this article). This version cunningly embedded what appeared to be legitimate “telemetry functionality.” However, this was merely a sophisticated ruse to exfiltrate critical data from cryptocurrency wallets.
The malware’s design was notably stealthy and straightforward. It activated its malicious payload only when the library’s core functionality was actively invoked by a developer. By deliberately avoiding common lifecycle scripts and not initiating its operations during the installation phase, the threat actors ensured the malware could operate under the radar, evading immediate detection.
Specifically, the poisoned version was found to subtly modify legitimate functions within workflows responsible for generating private keys. It injected a deceptive "trackKeyDerivation()" function, masquerading as a tool for collecting anonymized usage metrics aimed at SDK optimization. While its description promised benign data collection—”Tracks which key derivation methods are used (hex vs mnemonic) and derives timing patterns to help the SDK team identify performance bottlenecks…”—its true purpose was far more nefarious.
According to software supply chain security firm Socket, parameters passed to this function included a hard-coded marker detailing the key derivation method, alongside the actual sensitive information required to generate the private key. This captured material was sufficient for the threat actor to regenerate the private key, thereby compromising any associated cryptocurrency wallet.
Widespread Impact: Transitive Dependencies at Risk
The attack’s scope was not limited to a single package. The threat actor behind the compromise also published version 1.20.21 across an additional 17 @injectivelabs scoped packages. These packages were configured to depend on and specifically “pin” the malicious SDK version, extending the risk to transitive users who might not have directly installed the compromised library. The affected packages include:
@injectivelabs/utils@injectivelabs/networks@injectivelabs/ts-types@injectivelabs/exceptions@injectivelabs/wallet-base@injectivelabs/wallet-core@injectivelabs/wallet-cosmos@injectivelabs/wallet-private-key@injectivelabs/wallet-evm@injectivelabs/wallet-trezor@injectivelabs/wallet-cosmostation@injectivelabs/wallet-ledger@injectivelabs/wallet-wallet-connect@injectivelabs/wallet-magic@injectivelabs/wallet-strategy@injectivelabs/wallet-turnkey@injectivelabs/wallet-cosmos-strategy
The Exfiltration Pipeline: Sending Stolen Keys Home
OX Security further elaborated that the malware injected crypto wallet-stealing logic directly into the crypto wallet package itself. Every time a legitimate user created or utilized logic that read mnemonic phrases—essentially the master key for any crypto wallet—the malware would intercept and transmit this critical data to a remote server.
To minimize the footprint and reduce the number of outbound requests, the exfiltration mechanism was designed to be highly efficient. It would append multiple key derivations collected over a two-second window into a single queue, then dispatch them as a single HTTPS POST request to an external server: testnet.archival.chain.grpc-web.injective[.]network.
Compromise Vector: A Trusted Maintainer’s Identity
StepSecurity’s findings highlighted a particularly alarming aspect: the malicious release was facilitated through the repository’s own trusted-publisher (OIDC) pipeline. Even more concerning, the malicious commits were authored and pushed under the identity of an existing, trusted maintainer, “thomasRalee.” This suggests a direct compromise of the developer’s account or a sophisticated impersonation, underscoring the severe vulnerabilities that can arise from compromised developer credentials in the software supply chain.
Urgent Recommendations for Affected Users
For any users who have installed the malicious version @injectivelabs/sdk-ts@1.20.21 or any of its affected transitive dependencies, immediate and decisive action is critical:
- Update Immediately: Upgrade to the newly published, clean version of the package (
1.20.23) without delay. - Assume Compromise: Treat any private key or mnemonic phrase that has been passed through the compromised package as definitively compromised.
- Rotate Assets: Promptly rotate all affected private keys and mnemonic phrases. This involves moving all funds to new, secure wallets generated using uncompromised software.
- Check Dependencies: Conduct a thorough audit of your projects for any transitive dependencies that might have inadvertently pulled in the malicious version.
This incident serves as a stark and urgent reminder of the persistent and evolving threats within the software supply chain, especially when dealing with high-value digital assets like cryptocurrencies. Continuous vigilance and robust security practices are now more crucial than ever.
For more details, visit our website.
Source: Link
Leave a comment