Injective Labs SDK Compromised: Malicious npm Package Steals Crypto Wallet Keys
Remove the compromised @injectivelabs/sdk‑[email protected] package and audit your npm dependencies for malicious code.
Remove the malicious SDK version, replace with a verified release, and run a security scan on wallet applications.
Summary
Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the npm registry that steals cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/sdk‑[email protected], contains fake telemetry that exfiltrates data from cryptocurrency wallets. The malware targets wallet users by embedding telemetry code that captures private keys and seed phrases during normal operation. Jamf Threat Labs discovered the malicious package and noted that it was released after the repository compromise. No patch is available for the SDK, and users must rely on manual removal and dependency auditing. The incident highlights the risks of trusting third‑party npm packages for crypto applications. Security teams should remove the compromised SDK version and replace it with a verified release. The attackers used the npm registry as a distribution channel for the malicious code.
Key changes
- Injective Labs SDK GitHub repo compromised by threat actors
- Malicious npm package @injectivelabs/sdk‑[email protected] published to npm registry
- Package contains fake telemetry that exfiltrates wallet private keys and mnemonic seed phrases
- Targets cryptocurrency wallet users during normal operation
- No patch available; users must manually remove and audit dependencies
- Security teams should replace the SDK with a verified release and run a security scan