Security firm Socket has revealed that hackers compromised an Injective developer account and altered npm packages to collect wallet keys and recovery phrases. According to Socket, version 1.20.21 of the @injectivelabs/sdk-ts npm package, which receives approximately 50,000 weekly downloads, was altered after a developer's GitHub account was compromised. Suspicious commits began on June 8, and the malicious release was later pinned across 17 other packages under the Injective Labs npm scope. The large number of downloads makes the incident significant for developers and applications that handle Injective wallet workflows, as reported by Socket researchers.
The security firm explained that the code intercepted wallet key-derivation functions, recorded private keys and recovery phrases, then encoded the data and sent it through fake telemetry to a web address made to resemble an Injective server. Socket warned that any keys or mnemonics passed through affected packages should be treated as compromised, noting that applications may have been exposed even if they did not install the SDK directly. The compromised data was then encoded and sent to a web address that looked like a legitimate Injective network server, with the malicious code hooking into normal functions used to generate wallet keys. However, the malicious code remained inactive during installation and executed only when developers used the fromMnemonic or fromHex wallet generation functions, helping it evade detection during normal operations.
Injective CEO Eric Chen confirmed that the affected npm releases had been deprecated and the issue was fixed. Chen stated that no funds on the Injective network were at risk, while Socket did not report whether the malware resulted in stolen assets. However, Socket reported that the developer whose account was infiltrated quickly detected the compromise, but the malware had been downloaded more than 300 times and the campaign itself isn't yet fully contained. The compromised developer detected the intrusion quickly and the malicious package version has been removed, though Socket noted the campaign was not yet fully contained. Soon after the breach, a clean version v1.20.23 was made available, but the compromised version remained available on npm as a deprecated package, with its release artifacts still available on GitHub.
The attack represents a growing trend of supply-chain attacks targeting developer platforms rather than blockchain infrastructure directly. According to the Security Alliance, attackers have increasingly used platforms including GitHub, npm, and Google to distribute malware, with compromised machines sometimes used to push malicious code into company repositories. CertiK reported that wallet compromises caused $444 million in losses during the first half of 2026, making them the costliest crypto attack method across 33 cases. Recent similar attacks include a supply chain attack on Axios npm releases in March and a malware campaign called TrapDoor discovered in May targeting crypto, DeFi, AI and security developers.
Injective, an interoperable layer 1 for DeFi applications, has experienced significant decline with its total value locked falling 88% from a mid-2024 peak of $71 million to $8.2 million, according to DefiLlama data. Earlier this year, community members approved IIP-617, which accelerated reductions in new INJ issuance while retaining existing token burns. The Security Alliance reported in its second-quarter threat report that attackers are increasingly using legitimate platforms like GitHub, npm and Google to deliver payloads, with malware becoming more comprehensive including cross-platform capabilities and macOS-specific campaigns.
