Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

What it is

A supply-chain compromise of @injectivelabs/sdk-ts v1.20.21, published to npm at 22:59 GMT+2 on June 8, 2026 via commits from an established maintainer's GitHub account (pointing to account takeover, not a drive-by). It steals wallet mnemonics and private keys. Beyond the summary: the malicious code lives in two build artifacts, dist/cjs/accounts-Cy0p4lLW.cjs and dist/esm/accounts-jQ1GSgaW.js, byte-identical to the clean 1.20.23 build except for one injected block (falsely labeled src/utils/key-derivation-telemetry.ts) and two one-line hooks.

How it works

The hooks sit inside PrivateKey.fromMnemonic and PrivateKey.fromHex and fire before the real derivation, so every legitimate call leaks the secret. Records are tagged fm (mnemonic) or fh (hex) so the operator knows what each holds, queued, then flushed on a 2-second debounced timer: joined with |, base64-encoded, and sent.

The exfil detail the summary understates: the stolen blob rides in the X-Request-Id request header, not the body, with content type application/grpc-web+proto and (on the Node path) a zero-length body — so on the wire it mimics a normal gRPC-web call carrying a request ID. Every failure path is a silent empty catch. The destination host is stored as character codes and rebuilt at runtime, defeating plaintext bundle searches.

Preconditions / Affected

• Any project resolving @injectivelabs/sdk-ts@1.20.21, directly or transitively. The other 17 republished scope packages (e.g. @injectivelabs/wallet-core@1.20.21) have unmodified source but hard-pin the poisoned SDK — auditing only direct dependencies will miss this.
• Triggers only at runtime on key derivation. There are no install hooks; the scripts block is empty, so postinstall scanners and sandboxes see a clean package.

What to do

• Check for any @injectivelabs/* at version 1.20.21 anywhere in the resolved tree, including transitive pins.
• Upgrade to a clean release (the maintainer published 1.20.23; the reverted fix landed 23:48 GMT+2 on June 8).
• Treat any mnemonic or private key that passed through these packages as exposed. Per the page, the order matters: move the funds first, then rotate keys and seed phrases.
• Aikido users: filter the central feed on malware issues; this surfaces as a 100/100 critical issue.

Caveats

Containment is incomplete. As of the report the malicious 1.20.21 was deprecated but not removed from npm, so it remains downloadable, and the compromised release artifacts were still present on the project's GitHub releases page. Only 310 downloads occurred before the pull (against ~50k weekly / 87 dependents), but the window doesn't bound your exposure if a lockfile already captured it.