- Published on
Hackers tried to backdoor Injective npm package to steal wallet keys
- Authors
- Name
- DeepHorus
Hackers compromised a widely used npm package for the Injective blockchain in a supply chain attack, implanting malware designed to steal cryptocurrency wallet private keys and seed phrases. Security firm Socket discovered the malicious modification on Thursday in the @injectivelabs/sdk-ts package, which has about 50,000 weekly downloads. The incident underscores a growing trend of attackers targeting developer tools rather than blockchain networks directly.
The software supply chain attack vector exploits trusted platforms like npm to deliver malicious payloads. Injective, an interoperable layer 1 blockchain for decentralized finance, has seen its total value locked decline by 88% from a $71 million peak in mid-2024 to $8.2 million, according to DefiLlama. The compromised package version 1.20.21 was altered through a breached GitHub account belonging to a developer.
Suspicious commits began on June 8, and the malicious release was pinned across 17 other packages in the Injective Labs npm scope, potentially exposing users who did not directly install the SDK. Socket reported that the malware hooks into wallet key-derivation functions, secretly copying private keys and mnemonics, then exfiltrates them via fake telemetry to a web address mimicking a legitimate Injective server.
The malicious code was downloaded more than 300 times before detection. Socket stated, "Any keys or mnemonics passed through affected packages should be treated as compromised." Injective CEO Eric Chen confirmed the issue is fixed and affected npm versions are deprecated, adding that no funds on the network are at risk, though it is unclear if any funds were stolen.
This attack follows similar incidents, such as the Axios npm releases compromise in March and the TrapDoor malware campaign targeting crypto developers in May. The Security Alliance noted that attackers increasingly use legitimate platforms like GitHub, npm, and Google to deliver payloads.
Wallet compromises have become the most costly attack vector this year, according to SEAL's second-quarter threat report. The malware is also becoming more sophisticated, combining infostealers, remote access trojans, and backdoor capabilities. The incident highlights the need for developers to verify package integrity and for stricter security measures in open-source ecosystems.
