The usual update of the library to work with cryptocurrency wallets in 49 minutes turned into a trap that can transfer full control over users to the attackers. In the package @injectivelabs/sdk-ts for the Injective platform, a code was built that stole recovery phrases and private keys when the user created or downloaded Cryptocost.
The malicious code appeared on July 8, 2026 in version 1.20.21, published in the npm catalog. The package is included in the official set of Injective Labs development tools and helps applications create wallets, sign operations and interact with the Injective blockchain. According to Datadog Security Labs, the library is loaded about 175 thousand times a month.
The attacker disguised the theft of data for the collection of impersonal statistics. The added module allegedly measured how quickly the keys are created and how they are obtained, but in fact intercepted the recovery phrase or the private key at the time of contacting the functions PrivateKey.fromMnemonic() and PrivateKey.fromHex(). The data was coded and sent in the title X-Request-Id to a server with an address similar to the usual Injective infrastructure node.
The malware was not launched immediately after installation. The code worked only when the application really created or opened the wallet. This approach reduced the likelihood of rapid detection and at the same time ensured that the intercepted information will allow you to restore the keys and gain access to the cryptocurrency. A detailed analysis of the mechanism was published by Socket.
Malicious changes were made directly into the main branch of the official repository on behalf of the developer who had long participated in the project. Then the regular automatic assembly system itself prepared and published the infected version in the npm. Experts of StepSecurity believe that the attackers got access to the account of the trusted accompanying project. They did not need a separate key for publishing packages.
The attack affected not only the main set of development tools. At the same time, versions of 1.20.21 more 17 packages of Injective Labs were released, which referred to the infected library. There was no malicious code in them, but during installation they automatically downloaded a dangerous dependence. OX Security has counted 87 third-party packages that depend on compromised components.
The developers rolled back the changes and released a clean version of 1.20.23 about 49 minutes after the infection. However, a short proliferation time does not exclude damage. Socket recorded at least 310 downloads of the malicious version, and the saved copies could remain in intermediate storage and assembly environments.
Anyone who has installed packages @injectivelabs version 1.20.21, advise you to switch to 1.20.23 and check not only the direct, but also the nested dependencies. Recovery phrases and closed keys that were processed by the infected code should be considered disclosed. Wallet owners need to create new keys and transfer funds to secure addresses.
The malicious code appeared on July 8, 2026 in version 1.20.21, published in the npm catalog. The package is included in the official set of Injective Labs development tools and helps applications create wallets, sign operations and interact with the Injective blockchain. According to Datadog Security Labs, the library is loaded about 175 thousand times a month.
The attacker disguised the theft of data for the collection of impersonal statistics. The added module allegedly measured how quickly the keys are created and how they are obtained, but in fact intercepted the recovery phrase or the private key at the time of contacting the functions PrivateKey.fromMnemonic() and PrivateKey.fromHex(). The data was coded and sent in the title X-Request-Id to a server with an address similar to the usual Injective infrastructure node.
The malware was not launched immediately after installation. The code worked only when the application really created or opened the wallet. This approach reduced the likelihood of rapid detection and at the same time ensured that the intercepted information will allow you to restore the keys and gain access to the cryptocurrency. A detailed analysis of the mechanism was published by Socket.
Malicious changes were made directly into the main branch of the official repository on behalf of the developer who had long participated in the project. Then the regular automatic assembly system itself prepared and published the infected version in the npm. Experts of StepSecurity believe that the attackers got access to the account of the trusted accompanying project. They did not need a separate key for publishing packages.
The attack affected not only the main set of development tools. At the same time, versions of 1.20.21 more 17 packages of Injective Labs were released, which referred to the infected library. There was no malicious code in them, but during installation they automatically downloaded a dangerous dependence. OX Security has counted 87 third-party packages that depend on compromised components.
The developers rolled back the changes and released a clean version of 1.20.23 about 49 minutes after the infection. However, a short proliferation time does not exclude damage. Socket recorded at least 310 downloads of the malicious version, and the saved copies could remain in intermediate storage and assembly environments.
Anyone who has installed packages @injectivelabs version 1.20.21, advise you to switch to 1.20.23 and check not only the direct, but also the nested dependencies. Recovery phrases and closed keys that were processed by the infected code should be considered disclosed. Wallet owners need to create new keys and transfer funds to secure addresses.
