Executive Summary
In July 2026, attackers compromised the GitHub repository of Injective Labs' SDK project, leading to the publication of a malicious version (1.20.21) of the @injectivelabs/sdk-ts package on npm. This package, widely used for developing applications on the Injective blockchain, was altered to steal cryptocurrency wallet private keys and mnemonic seed phrases. The breach was detected promptly, and a clean version (1.20.23) was released. However, the malicious package was downloaded 310 times before deprecation, potentially compromising numerous developer systems.
This incident underscores the escalating threat of supply-chain attacks targeting open-source ecosystems, particularly within the cryptocurrency sector. The rapid detection and response highlight the importance of vigilant monitoring and swift action in mitigating such threats.
Why This Matters Now
The increasing frequency of supply-chain attacks in the open-source community poses significant risks to developers and end-users, especially in the cryptocurrency domain. Immediate awareness and proactive security measures are essential to prevent potential financial losses and maintain trust in decentralized platforms.
Attack Path Analysis
An attacker compromised a legitimate contributor's GitHub account to inject malicious code into the Injective SDK, leading to the distribution of a backdoored npm package. Upon installation, the malicious package exfiltrated cryptocurrency wallet private keys and mnemonic seed phrases to an attacker-controlled server. The attacker then used these credentials to access and transfer victims' digital assets, resulting in financial losses.
Kill Chain Progression
Initial Compromise
Description
The attacker gained unauthorized access to a legitimate contributor's GitHub account and injected malicious code into the Injective SDK repository.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
Input Capture: Keylogging
Exfiltration Over C2 Channel
Application Layer Protocol: Web Protocols
Unsecured Credentials: Credentials in Files
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Supply Chain Risk Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply-chain attack compromising npm SDK packages directly threatens software development workflows, requiring enhanced egress security and zero trust segmentation for developer environments.
Financial Services
Cryptocurrency wallet stealer targeting DeFi applications poses severe asset theft risks, demanding strengthened threat detection and encrypted traffic controls for digital finance operations.
Venture Capital/VC
Malicious SDK affecting blockchain infrastructure investments exposes portfolio companies to credential theft, necessitating multicloud visibility and anomaly response across crypto holdings.
Internet
GitHub repository compromise affecting 87 dependent packages demonstrates critical need for inline IPS and cloud firewall protection against supply-chain infiltration vectors.
Sources
- Injective SDK on npm infected with cryptocurrency wallet stealerhttps://www.bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer/Verified
- Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonicshttp://socket.dev/blog/compromised-injective-sdk-npm-packageVerified
- Injective Labs npm Package Hijacked, Impacting 87 Dependent Packageshttps://www.ox.security/blog/injectivelabs-npm-package-hijacked-impacting-87-dependent-packages/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to move laterally and exfiltrate sensitive data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While Aviatrix CNSF may not prevent the initial compromise of external accounts, it could limit the attacker's ability to exploit internal systems by enforcing strict access controls.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation could limit the attacker's ability to escalate privileges within the internal network by enforcing strict segmentation policies.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security could limit the attacker's ability to move laterally within the network by enforcing strict workload-to-workload communication policies.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control could detect and limit unauthorized outbound communications, thereby reducing the attacker's ability to establish command and control channels.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement could limit the attacker's ability to exfiltrate sensitive data by enforcing strict outbound traffic policies.
While Aviatrix CNSF may not prevent the misuse of exfiltrated credentials, it could limit the attacker's ability to access internal systems, thereby reducing the overall impact of the breach.
Impact at a Glance
Affected Business Functions
- Cryptocurrency Wallet Development
- Decentralized Exchange Operations
- DeFi Application Development
- Payment Processing Tools
Estimated downtime: N/A
Estimated loss: N/A
Private keys and mnemonic seed phrases of cryptocurrency wallets were exposed, potentially compromising user funds.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access and limit the impact of compromised accounts.
- • Enforce East-West Traffic Security to monitor and control internal traffic, preventing lateral movement.
- • Deploy Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration attempts.
- • Utilize Multicloud Visibility & Control to gain comprehensive insights into network activities across cloud environments.
- • Apply Inline IPS (Suricata) to identify and block known exploit patterns and malicious payloads.
