Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys

On July 8, 2026, attackers compromised a trusted developer's account to inject a backdoor into the @injectivelabs/sdk-ts npm package, a core SDK for the Injective blockchain. The malicious code captured cryptocurrency wallet recovery phrases and private keys during wallet creation or loading and exfiltrated them to an attacker-controlled server disguised as legitimate infrastructure. The backdoor was distributed across 18 related npm packages for less than an hour before being detected and reverted, posing a significant risk to any application that installed the tainted versions during that window.

AI-extracted · verify before operational use