Listen to this Post
Introduction
The npm ecosystem witnessed yet another sophisticated supply chain attack on July 9, 2026, when the widely-used `@injectivelabs/sdk-ts` package — a TypeScript SDK for building Injective blockchain applications with roughly 50,000 weekly downloads — was compromised with malicious code designed to exfiltrate wallet private keys and mnemonic phrases. What makes this incident particularly alarming is that the attack occurred on the very same day npm v12 was released with enhanced security features, proving that registry-side defenses alone cannot stop determined adversaries. The attacker, having compromised a legitimate developer account with an established contribution history, published version 1.20.21 containing stealthy wallet-draining logic that hooks into the SDK’s mnemonic handling functions.
Learning Objectives
- Understand the technical mechanics of how the `@injectivelabs/sdk-ts` malicious payload exfiltrates cryptographic secrets through hooking wallet derivation functions
- Learn to detect compromised npm packages using static analysis, behavioral monitoring, and supply chain security tools
- Implement practical mitigation strategies including script blocking, package pinning, and provenance verification
- Master defensive commands and configurations across Linux, Windows, and CI/CD environments
You Should Know
- Technical Deep Dive: How the Malicious Payload Works
The malicious functionality in `@injectivelabs/[email protected]` is minimalistic yet highly effective. Unlike many supply chain attacks that trigger at install time via `postinstall` hooks, this payload executes during runtime usage of the library — a design choice that keeps the malicious behavior under the radar of traditional install-time scanners.
The malicious code resides in two locations within the package:
– `/dist/esm/accounts-jQ1GSgaW.js` (ES module)
– `/dist/cjs/accounts-Cy0p4lLW.cjs` (CommonJS)
The attack hooks two critical functions used in legitimate wallet workflows:
// The PrivateKey class — the attacker hooks fromMnemonic and fromHex
var PrivateKey = class PrivateKey {
constructor(wallet) {
// Standard wallet initialization
}
}
// Hooked function — each time a developer derives a key from a mnemonic,
// the malware captures and exfiltrates it
function fromMnemonic(mnemonic, path) {
const key = legitimatelyDeriveKey(mnemonic, path);
trackKeyDerivation(mnemonic, key); // 👈 Malicious exfiltration call
return key;
}
The `trackKeyDerivation` function collects the mnemonic phrase and derived private key, then sends them to a remote C2 server masquerading as a legitimate Injective endpoint: testnet.archival.chain.grpc-web[.]injective[.]network.
The attack chain is as follows:
- Developer installs `@injectivelabs/[email protected]` (either directly or transitively through one of 17 scoped packages that pinned this version)
- Application code calls `PrivateKey.fromMnemonic()` or `PrivateKey.fromHex()` as part of normal wallet operations
- The hooked function silently captures the mnemonic/private key
- Data is exfiltrated to the attacker-controlled C2 server
- Attacker gains full control of the victim’s cryptocurrency wallet
Scope of Impact: The attacker didn’t stop at the primary package. They published version 1.20.21 across 17 additional @injectivelabs scoped packages, each pinned to the malicious SDK version. Combined with 87 downstream dependents, the total download count accumulated to 112,378.
- Detection: How to Identify If You’ve Been Compromised
Immediate action is required if your project uses any `@injectivelabs` packages. Here’s how to check:
Check your `package.json` and `package-lock.json`:
Linux / macOS / Windows (Git Bash / PowerShell) Check if malicious version is present grep -r "@injectivelabs/sdk-ts\"1.20.21" package.json package-lock.json List all @injectivelabs packages and their versions npm list @injectivelabs --depth=5 Check for any version 1.20.21 across all scoped packages npm list | grep "1.20.21"
Using Socket’s security scanner (recommended):
Install Socket CLI npm install -g @socketsecurity/cli Scan your project for malicious packages socket scan Check a specific package socket scan @injectivelabs/[email protected]
Socket detected this package as known-malware with a clear alert. The OpenSSF Package Analysis project also flagged related malicious packages.
For CI/CD pipelines, add automated checks:
GitHub Actions example - name: Scan for malicious npm packages run: | npm install -g @socketsecurity/cli socket scan --json > socket-report.json if grep -q "DANGER" socket-report.json; then echo "⚠️ Malicious package detected!" exit 1 fi
Windows PowerShell equivalent:
Check for malicious package Get-Content package.json | Select-String "@injectivelabs/sdk-ts.1.20.21" List all installed @injectivelabs packages npm list @injectivelabs --depth=5
3. Immediate Mitigation: Removing the Malicious Package
If you find version 1.20.21 of any `@injectivelabs` package in your project, take these steps immediately:
Step 1: Remove the malicious version
Uninstall the specific package npm uninstall @injectivelabs/sdk-ts If you have multiple scoped packages, remove them all npm uninstall @injectivelabs/sdk-ts @injectivelabs/utils @injectivelabs/networks \ @injectivelabs/ts-types @injectivelabs/exceptions @injectivelabs/wallet-base \ @injectivelabs/wallet-core @injectivelabs/wallet-cosmos \ @injectivelabs/wallet-private-key @injectivelabs/wallet-evm \ @injectivelabs/wallet-trezor @injectivelabs/wallet-cosmostation \ @injectivelabs/wallet-ledger @injectivelabs/wallet-wallet-connect \ @injectivelabs/wallet-magic @injectivelabs/wallet-strategy \ @injectivelabs/wallet-turnkey @injectivelabs/wallet-cosmos-strategy
Step 2: Install a clean version
The maintainers published a clean version shortly after the attack was detected. Update to the latest safe version:
Install the latest clean version (check npm for the current version) npm install @injectivelabs/sdk-ts@latest Or install a specific known-good version (avoid 1.20.21) npm install @injectivelabs/[email protected]
Step 3: Clear npm cache and reinstall
Clear cache to ensure no cached malicious artifacts remain npm cache clean --force Delete node_modules and reinstall rm -rf node_modules package-lock.json npm install
Step 4: Rotate all exposed secrets
If you used any wallet functionality during the window when the malicious version was installed (June 8–July 9, 2026), assume your mnemonics and private keys are compromised:
- Immediately transfer all funds to a new wallet with fresh keys
- Generate new mnemonics — never reuse the exposed ones
3. Enable 2FA on all cryptocurrency wallets
- Check for suspicious transactions on all associated addresses
-
Proactive Defense: Hardening npm Against Supply Chain Attacks
The Injective incident occurred on the same day npm v12 was released, underscoring that attackers are actively targeting the window between security announcements and widespread adoption. Here’s how to harden your environment:
Enable npm v12’s script-blocking features (available in npm 11.16.0+):
Upgrade to npm 11.16.0 or later to get warning mechanisms npm install -g [email protected] Preview which scripts would be blocked npm approve-scripts --allow-scripts-pending Approve trusted packages and commit the allowlist npm approve-scripts This writes to package.json — commit this file! Deny suspicious packages npm deny-scripts <package-1ame>
In npm v12 (expected July 2026), `npm install` will no longer execute preinstall, install, or `postinstall` scripts from dependencies by default. The `allowScripts` configuration defaults to off.
Additional hardening measures:
Disable Git dependency resolution (npm v12 default) npm config set allow-git none Disable remote tarball resolution (npm v12 default) npm config set allow-remote none Enforce minimum package age (prevents installation of brand-1ew malicious packages) npm config set min-age 72h
For pnpm users (which ships security-by-default controls):
pnpm v10+ blocks lifecycle scripts by default pnpm install --ignore-scripts Explicitly block all scripts Use pnpm's built-in security features pnpm audit --fix
For Yarn users:
Disable install scripts
yarn install --ignore-scripts
Use Yarn's selective dependency resolutions to pin safe versions
In package.json:
{
"resolutions": {
"@injectivelabs/sdk-ts": "1.20.20"
}
}
5. Trust but Verify: Package Provenance and Integrity
The Injective attack succeeded because a legitimate developer account was compromised. While provenance attestations wouldn’t have prevented the account takeover, they would have provided a cryptographically signed link between the published package and the source commit.
Verify package provenance:
Check if a package has provenance attestation npm audit signatures The npm CLI shows provenance information during audit Look for the green checkmark indicating valid provenance
Use Sigstore for verification:
Install Sigstore CLI npm install -g sigstore Verify a package's provenance sigstore verify npm:@injectivelabs/[email protected]
Pin dependencies with integrity hashes:
Generate integrity hash for a specific version npm install @injectivelabs/[email protected] --package-lock-only In package-lock.json, the integrity field provides a SHA-512 hash Example: "integrity": "sha512-abc123def456..."
Use `npm ci` instead of `npm install` in CI/CD:
npm ci respects package-lock.json and fails if the lockfile is out of sync This prevents accidental installation of malicious versions npm ci --ignore-scripts
- Monitoring and Incident Response for Supply Chain Attacks
Organizations should establish continuous monitoring for supply chain threats. Here’s a practical framework:
Set up automated monitoring:
Daily scan using Socket 0 0 /usr/local/bin/socket scan --json > /var/log/socket-scan-$(date +\%Y\%m\%d).json Monitor for new malicious packages using npm audit npm audit --json > npm-audit-report.json
Integrate with SIEM/SOAR:
// Example: Parse Socket scan results for alerting
{
"packages": [
{
"name": "@injectivelabs/sdk-ts",
"version": "1.20.21",
"status": "DANGER",
"reason": "Known malware - exfiltrates wallet keys"
}
]
}
Windows Event Log monitoring (PowerShell):
Monitor npm install events in Windows
Get-WinEvent -LogName "Application" | Where-Object { $_.Message -match "npm install" }
Create a scheduled task to scan daily
$action = New-ScheduledTaskAction -Execute "npm" -Argument "audit --json > C:\logs\npm-audit.json"
$trigger = New-ScheduledTaskTrigger -Daily -At "00:00"
Register-ScheduledTask -TaskName "npm-audit" -Action $action -Trigger $trigger
Incident response checklist for supply chain attacks:
- Identify — Determine which packages and versions are affected
- Contain — Isolate affected systems and prevent further installation
- Eradicate — Remove malicious packages and rotate all exposed credentials
- Recover — Restore from known-good backups and verify integrity
- Learn — Conduct post-mortem and update security controls
-
The Bigger Picture: Why Supply Chain Attacks Are Accelerating
The `@injectivelabs/sdk-ts` incident is not isolated. In 2026 alone, we’ve witnessed:
- The Shai-Hulud worm compromising 796 packages with 132 million monthly downloads
- Glassworm proving these are not isolated incidents but a new attack paradigm
- IronWorm targeting developers through poisoned npm packages, stealing credentials, API keys, and cryptocurrency wallet recovery phrases
- Mastra npm supply chain attack compromising over 140 packages with obfuscated `postinstall` payloads
- SlowMist detecting 30 malicious npm packages targeting DeFi developers with JavaScript info-stealers
Attackers are increasingly targeting developer credentials rather than end-users because compromising a single maintainer can poison thousands of downstream applications. The npm registry remains the target of 75% of new malicious attacks.
The economics favor attackers — publishing a convincing package, compromising a maintainer, or exploiting dependency confusion gives attackers access to build pipelines with secrets, source code, tokens, and deployment credentials. Traditional malware targets endpoints; npm-based compromises operate inside the trusted development environment.
What Undercode Say
- Key Takeaway 1: The Injective SDK attack represents a dangerous evolution in supply chain threats — by hooking runtime functions rather than install-time scripts, the malware evades many detection mechanisms while targeting the exact moment developers handle sensitive cryptographic material. This shifts the attack surface from “install and forget” to “use and lose.”
-
Key Takeaway 2: The timing of this attack — coinciding with npm v12’s release — reveals that attackers are actively monitoring security announcements and rushing to exploit the gap between awareness and adoption. Organizations cannot wait for registry-side fixes; they must implement client-side defenses like script blocking, package pinning, and integrity verification immediately.
Analysis: What makes this incident particularly insidious is the attacker’s understanding of developer behavior. By compromising a legitimate contributor account with an established history, the malicious commits didn’t trigger immediate suspicion. The use of a C2 domain resembling a legitimate Injective endpoint (testnet.archival.chain.grpc-web[.]injective[.]network) further demonstrates sophisticated operational security. The rapid detection and containment (malicious version published at 22:59, reverted at 23:18, clean version at 23:48) suggests that either automated monitoring caught the anomaly or the true account owner noticed unusual activity quickly. However, the 87 dependent packages and 112,378 downloads during that window represent a significant exposure. The fact that release artifacts remained on GitHub at the time of writing highlights the challenge of fully eradicating malicious content once published. Developers must adopt a zero-trust mindset toward dependencies: verify provenance, block scripts, pin versions, and never assume that a package’s popularity or maintainer reputation guarantees safety.
Prediction
- +1 The npm v12 script-blocking defaults will significantly reduce the attack surface for install-time malware, potentially cutting the success rate of postinstall-based supply chain attacks by 60-70% within 12 months of widespread adoption.
-
-1 Attackers will pivot to runtime-hooking techniques like those used in the Injective attack, making detection more challenging and requiring next-generation runtime application self-protection (RASP) tools for JavaScript ecosystems.
-
-1 The consolidation of package managers (npm, pnpm, Yarn) around security defaults will create a false sense of security, leading organizations to neglect other critical controls like provenance verification, dependency scanning, and credential rotation.
-
+1 The open-source community’s rapid response to the Injective incident (full revert within 49 minutes) demonstrates the effectiveness of coordinated vulnerability disclosure and ecosystem-wide alerting when properly implemented.
-
-1 As cryptocurrency and DeFi applications continue to grow, we will see an increase in highly targeted supply chain attacks specifically designed to compromise wallet generation logic, with attackers willing to invest significant resources to compromise high-value targets.
-
+1 The rise of AI-powered code analysis tools will enable faster detection of obfuscated malicious code, potentially reducing the window between publication and detection from hours to minutes in the coming years.
-
-1 The economics of supply chain attacks remain favorable to attackers — as long as one compromised maintainer can poison thousands of applications, the ROI for these attacks will continue to drive innovation in evasion techniques.
▶️ Related Video (84% Match):
https://www.youtube.com/watch?v=1DSJ5YsZiKE
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Hexploit Malicious – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
