What happened with the Injective SDK package in npm?

Hackers compromised the Injective Labs GitHub repository and replaced the legitimate package with a malicious one that steals cryptocurrency wallet data. The package was distributed via npm.

What data did the malicious package steal?

The malicious package collected private keys and mnemonic seed phrases from users' cryptocurrency wallets, allowing attackers to gain unauthorized access to their funds.

How can developers protect against such attacks?

Developers are advised to verify project dependencies, use security analysis tools for packages, and monitor updates from official sources to mitigate supply chain risks.

← All news

Security

Malicious Injective SDK Package Found in npm Stealing Crypto Wallets

July 9, 2026

Photo: BleepingComputer

Quick answer

Attackers breached the Injective Labs repository and published a malicious npm package that steals private keys and seed phrases from cryptocurrency wallets.

Cybercriminals breached the Injective Labs GitHub repository and injected malicious code into the SDK package, which was then published to the npm registry. This package included functionality to steal sensitive user data, including private keys and seed phrases from cryptocurrency wallets.

The incident occurred due to compromised developer credentials or vulnerabilities in the version control system. Attackers exploited a legitimate software distribution channel to target developers, making such attacks particularly dangerous.

Cybersecurity experts recommend that developers thoroughly audit all dependencies in their projects, especially those related to cryptocurrency services. To mitigate such threats, it is also essential to use package security analysis tools and monitor updates from official sources.

Injective Labs has responded to the incident by removing the malicious package from npm and releasing a corrected version of the SDK. Users are advised to update to the latest version and scan their systems for suspicious activity.

Common questions

What happened with the Injective SDK package in npm?: Hackers compromised the Injective Labs GitHub repository and replaced the legitimate package with a malicious one that steals cryptocurrency wallet data. The package was distributed via npm.
What data did the malicious package steal?: The malicious package collected private keys and mnemonic seed phrases from users' cryptocurrency wallets, allowing attackers to gain unauthorized access to their funds.
How can developers protect against such attacks?: Developers are advised to verify project dependencies, use security analysis tools for packages, and monitor updates from official sources to mitigate supply chain risks.

Dzen feed: /feed/dzen.xml · RSS: /feed.xml