Injective says a supply-chain attack affecting its npm developer tools did not put user funds at risk, even though the compromised packages were capable of stealing private keys and seed phrases during a brief release window.
The issue centered on version 1.20.21 of @injectivelabs/sdk-ts, a software package used in wallets, exchange interfaces and trading bots. According to security warnings cited in the report, attackers inserted malicious code into that release and into 17 related official npm packages that depended on it.
Compromised release window
The backdoored code was reportedly hidden in a fake analytics file. It targeted functions used to derive wallet credentials, specifically PrivateKey.fromMnemonic() and PrivateKey.fromHex(). A routine called trackKeyDerivation() was presented as an SDK optimization feature, but was described as actually collecting private keys and seed phrases and transmitting them to a remote server.
The source article says the destination was disguised to look like an Injective address. Because the tainted sdk-ts version was pinned across 17 other official packages, the exposure extended beyond developers using the main package directly.
Injective’s response
Injective Labs said it identified and resolved the incident within an hour. The company also stated that no funds were ever at risk or compromised, pushing back on concerns raised after the malicious release was discovered.
To replace the affected versions, clean releases numbered 1.20.23 were published. Injective advised developers to move to the fixed version as soon as possible.
What developers were told to do
Although Injective said funds were not endangered, its guidance treated any secrets that passed through the compromised packages as exposed. Developers were told to rotate any private keys or seed phrases processed by the affected software and to review dependency files for signs that the malicious release had been installed.
Specifically, the company recommended checking package-lock.json and yarn.lock for references to version 1.20.21. That step is important because developers may have pulled in the compromised code indirectly through one of the 17 linked official packages rather than by installing @injectivelabs/sdk-ts on its own.
Broader context
The episode is the latest example of how software supply-chain attacks can affect crypto infrastructure through widely used development libraries rather than direct breaches of wallets or exchanges. In this case, the reported danger came from any private keys or seed phrases handled by the compromised npm packages during the short period before the clean 1.20.23 releases were issued, even as Injective maintained that no funds were ultimately compromised.
Source: Cryptopolitan