- Attackers pushed wallet-key-stealing code into 18 of Injective’s official npm developer packages.
- Socket says private keys and seed phrases passed through the software should be treated as compromised.
- Injective and CEO Eric Chen say the issue was fixed within the hour, and no network funds were at risk.
Injective has dismissed concerns that user funds were compromised after attackers planted wallet-key-stealing code in 18 of its official npm developer packages.
Meanwhile, security firms warn that the attack exposed the private keys and seed phrases that passed through the software.
What happened to Injective?
The attack on Injective started when two malicious code changes were pushed directly to the main code branch under the name “thomasRalee” who is a real developer that had previously contributed to the project.
There was no code review or pull request, which is unusual, but this gap allowed the bad code to bypass security checks.
The malicious code, found by the security firm Socket, was hidden inside version 1.20.21 of @injectivelabs/sdk-ts, the TypeScript SDK that wallets, exchange front ends, and trading bots use to build on Injective.
The attackers reportedly added a fake analytics file that hooked into PrivateKey.fromMnemonic() and PrivateKey.fromHex(), both of which are critical functions used to turn a user’s seed phrase or raw private key into a signing key for transactions.
The malicious function was named trackKeyDerivation(), and it claimed to collect user data for “SDK optimization,” but in reality, it stole the secret keys and seed phrases being passed through the software and sent them to a remote server. The server’s address was disguised to look like an official Injective domain, making it harder to detect.
The compromised version 1.20.21 was pinned across 17 other official @injectivelabspackages, meaning developers could be exposed even if they only used a related tool.
Despite the fact that the bad packages were only available for less than one hour, the tainted release was downloaded more than 300 times. Normally, the SDK sees around 50,000 weekly downloads. Clean versions, labeled 1.20.23, were released to replace them.
Injective Labs addressed the incident directly in a post on X on Thursday, saying that the issue was identified and resolved immediately.
“No funds were ever at risk, and no funds were compromised,” the Injective account wrote. The company’s CEO Eric Chen said separately that the affected npm releases had been deprecated and the problem fixed.
Socket said the campaign had not been fully contained at the time of its report, and did not say whether any assets were actually stolen.
How can users protect their wallets?
Developers are advised to immediately upgrade to the clean version 1.20.23 or later to remove the malicious code. StepSecurity advised that anyone whose application pulled in the bad release, or a cached copy since, should treat the wallet secrets it touched as exposed and rotate them.
Users are also advised to check package-lock.json or yarn.lock files for any reference to version 1.20.21, as other packages may have pulled it in automatically.
CertiK reported that wallet compromises account for $444.5 million stolen across 33 incidents in the first half of 2026.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
Which Injective npm packages were compromised?
The malicious version 1.20.21 shipped inside `@injectivelabs/sdk-ts`, which carried the payload, and was pinned across 17 other packages in the Injective Labs npm scope, for 18 packages in total.
How did the attackers steal the wallet keys?
Socket found the code hooked into the SDK's key-generation functions and, under a fake telemetry function called `trackKeyDerivation()`, captured private keys and seed phrases before sending them to a server disguised as an Injective address.
What should developers who used the affected version do?
Update to the clean release, version 1.20.23, treat any private key or seed phrase that passed through the package as compromised and rotate it, and check for transitive dependencies that may have pulled in the bad SDK.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
