The Injective Labs TypeScript SDK npm package version 1.20.21 was compromised through a developer account breach. The attacker injected malware that hooks wallet key generation functions to capture private keys and mnemonic phrases. This sensitive data was exfiltrated using base64-encoded POST requests sent to legitimate Injective infrastructure endpoints, masking malicious activity as normal traffic. The attacker further amplified the impact by publishing 17 additional scoped packages pinned to the malicious version. Despite rapid detection and containment within hours, the malicious package was downloaded approximately 310 times. Given the package's typical weekly download volume (~50,000) and 87 dependent packages, this represents a notable supply chain threat to cryptocurrency wallet implementations relying on this SDK.

The compromise enables theft of cryptocurrency wallet private keys and mnemonic phrases, potentially leading to unauthorized access and theft of cryptocurrency assets. The supply chain nature of the attack means multiple downstream projects depending on the Injective SDK could be affected if they incorporated the malicious version. The exfiltration method disguises data theft as legitimate network traffic, complicating detection. Although the malicious version was quickly removed, the downloads that occurred pose a risk to affected users and projects.

The malicious package version 1.20.21 should be considered compromised and avoided. Users and developers should verify they are not using this specific version or any packages pinned to it. Since the incident was contained within hours, upgrading to a clean, verified version of the Injective SDK is recommended. No official patch or fix is indicated, but avoiding the compromised version and its derivatives effectively mitigates the threat. Users should also review their wallet security and consider rotating keys if they used the affected version.