Injective Labs npm Supply-Chain Compromise

On 2026-07-08, a threat actor published a backdoored release of @injectivelabs/sdk-ts — a TypeScript SDK with roughly 175k monthly downloads used to build crypto wallets, trading bots, DEX front-ends, and DeFi tooling. The malicious commits were authored and pushed under the identity of an existing trusted maintainer and shipped through the project's own GitHub OIDC trusted-publisher (provenance) pipeline, so the poisoned 1.20.21 release carried an air of legitimacy.

The backdoor hooks two key-derivation functions — PrivateKey.fromMnemonic() and PrivateKey.fromHex() — via a trackKeyDerivation() routine. Every time a downstream app derives a key, the BIP-39 mnemonic or raw private key is captured, base64-encoded, and smuggled inside the X-Request-Id HTTP header of a request to testnet.archival.chain.grpc-web.injective[.]network. The actor also pinned 1.20.21 across 17 additional @injectivelabs-scoped packages, exposing transitive dependents who never installed the SDK directly. The malicious version was live for about 49 minutes (downloaded ~310 times) before maintainers reverted and published clean 1.20.23; the deprecated version and GitHub release artifacts may still be reachable.

Defender priority: Treat any crypto wallet key or mnemonic handled on a host that resolved 1.20.21 as compromised — rotate immediately. The single highest-fidelity endpoint catch is DNS/beacon to the exfil host testnet.archival.chain.grpc-web.injective.network (Q1); the authoritative catch is an SCA/lockfile sweep for the poisoned version and its 17 sibling packages (Section 7).

Two independent vendor teardowns (Socket + Datadog) agree on the exfil host and the hooked functions; this is high-confidence intel. The exfil hostname is a lookalike of legitimate Injective infrastructure — scope carefully before global blocking (see Q1 tuning).

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A developer/build/wallet host resolved or beaconed to testnet.archival.chain.grpc-web.injective.network. → Q1
2. H2 (high, native): A repo lockfile or node_modules pins any @injectivelabs package at 1.20.21. → Section 7 SCA sweep, Q3
3. H3 (medium): A package manager installed/updated @injectivelabs around 2026-07-08. → Q2
4. H4 (medium): @injectivelabs package files were written into node_modules on an endpoint. → Q3
5. H5 (scoping): Which hosts use the Injective SDK at all (exposure inventory)? → Q4

Attack chain

Indicators trace to Socket and Datadog Security Labs (both 2026-07-09), corroborated by BleepingComputer and The Hacker News. The exfil host is a lookalike of legitimate Injective infrastructure — validate before global block.

The malicious 1.20.21 pin also affects these 17 scoped packages (full list in Section 10): utils, networks, ts-types, exceptions, wallet-base, wallet-core, wallet-cosmos, wallet-private-key, wallet-evm, wallet-trezor, wallet-cosmostation, wallet-ledger, wallet-wallet-connect, wallet-magic, wallet-strategy, wallet-turnkey, wallet-cosmos-strategy.

For a JS supply-chain compromise the registry/SCA surface is authoritative — run these first, they beat any endpoint query:

• Lockfile / SBOM sweep (highest fidelity): grep every repo, build image, and artifact cache for 1.20.21 under any @injectivelabs package in package-lock.json, yarn.lock, pnpm-lock.yaml, and SBOMs. Any hit = exposed.
• Installed tree check: on dev/build hosts run npm ls @injectivelabs/sdk-ts (and the 17 sibling packages) and confirm the resolved version is not 1.20.21.
• Registry mirror / proxy logs: query your internal npm proxy (Artifactory/Verdaccio/Nexus) for downloads of any @injectivelabs package version 1.20.21 since 2026-07-08.
• Egress proxy header inspection: if a TLS-terminating proxy is in place, hunt outbound requests to *.grpc-web.injective.network carrying an anomalous X-Request-Id (long base64) header.
• CI/CD + VCS audit: review GitHub Actions OIDC trusted-publisher config and release history for the Injective SDK repo; verify npm provenance attestations on installed versions; look for release artifacts published in the compromise window.
• Secrets exposure: enumerate hosts/CI that handle wallet mnemonics or private keys and cross-reference against exposed repos — those keys are compromised.

This is a JavaScript supply-chain compromise: the key-theft hook runs inside Node and is not endpoint-observable. The queries below cover the network exfil and install/file artifacts; the authoritative detection is the SCA/lockfile sweep in Section 7. Coverage gaps are flagged in Section 15.

// HUNT: DNS to the Injective SDK backdoor exfil host
// MITRE: T1041 / T1071.001 | CONF: high  FP: medium  COST: low | REQUIRES: DnsRequest
// TUNING: match the EXACT FQDN; allowlist known-legit Injective infra endpoints in use by sanctioned apps
#event_simpleName=/DnsRequest/
| DomainName=/^testnet\.archival\.chain\.grpc-web\.injective\.network$/i
| table([ComputerName, aid, DomainName, ContextBaseFileName], limit=200)

// HUNT: npm/yarn/pnpm install of @injectivelabs (triage list for version check)
// MITRE: T1195.002 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// TUNING: after a hit, run `npm ls @injectivelabs/sdk-ts` on the host; only 1.20.21 is malicious
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(node\.exe|npm\.cmd|npm|yarn|yarn\.cmd|pnpm|pnpm\.cmd)$/i
| CommandLine=/@injectivelabs/i
| table([ComputerName, aid, FileName, CommandLine, ParentBaseFileName], limit=200)

// HUNT: @injectivelabs package files landing in node_modules
// MITRE: T1195.002 | CONF: medium  FP: medium  COST: low | REQUIRES: FileCreateInfo
// TUNING: JS file-write telemetry is partial; pair with Section 7 lockfile sweep for authoritative coverage
#event_simpleName=/FileCreateInfo|NewExecutableWritten/
| TargetFileName=/@injectivelabs\\(sdk-ts|wallet-|utils|networks|ts-types|exceptions)/i
| table([ComputerName, aid, TargetFileName, ContextBaseFileName], limit=200)

// HUNT: exposure inventory — node/electron resolving Injective gRPC infra
// MITRE: T1195.002 | CONF: low  FP: high  COST: low | REQUIRES: DnsRequest
// TUNING: scoping-only; do NOT alert on this — feed hits into the lockfile/npm-ls sweep
#event_simpleName=/DnsRequest/
| DomainName=/grpc-web\.injective\.network$/i
| ContextBaseFileName=/^(node\.exe|electron\.exe)$/i
| table([ComputerName, aid, DomainName, ContextBaseFileName], limit=200)

IOA-1 · Beacon to the backdoor exfil host

Type: Network / DNS. Domain (exact): testnet.archival.chain.grpc-web.injective.network. Action: Detect, and block the FQDN at the egress proxy. Exclusion: none — no sanctioned workload should reach this exact host.

The remaining queries are hunt/triage or scoping and are not IOA-promotion candidates — a legitimate SDK install is indistinguishable from a malicious one at the endpoint layer, so the version decision belongs to SCA/registry tooling (Section 7), not a Custom IOA. Promote IOA-1 only.

Playbook A — Remediate the poisoned dependency (bash / npm)

# 1. Sweep every repo for the poisoned pin
grep -rEl "@injectivelabs/[a-z-]+.{0,40}1\.20\.21" --include '*lock*' .

# 2. Pin to a clean version and rebuild deterministically
npm pkg set dependencies.@injectivelabs/sdk-ts=1.20.23
rm -rf node_modules package-lock.json
npm install --ignore-scripts
npm ci

# 3. Purge the poisoned version from the local + CI cache
npm cache verify
npm cache clean --force

Playbook B — Block exfil host + confirm no beacons (bash)

# Proxy/firewall: deny the exact exfil FQDN
# (example: add to blocklist ACL, then verify no host has resolved it)
echo "testnet.archival.chain.grpc-web.injective.network" | tee -a /etc/proxy/blocklist.d/injective-npm.txt
# Then run HuntPack Q1 in Falcon to confirm zero resolutions fleet-wide.

Playbook C — CI hardening (workflow policy)

# package.json - enforce clean, script-free installs
npm pkg set scripts.preinstall="echo use npm ci"
# CI step: install with a frozen lockfile and no lifecycle scripts
npm ci --ignore-scripts
# Enable SCA gate (example: Socket / OSV) as a required status check on PRs
# Require npm provenance verification before promotion to the internal proxy

Known gaps (honest): the actual key theft and the trackKeyDerivation() hook run inside Node and are not endpoint-observable — there is no CQL that proves theft occurred, so the response model is "assume compromise and rotate." Endpoint queries (Q2/Q3) only build an exposure list; the authoritative detection is the SCA/lockfile sweep in Section 7. Validation gates (Section 11) must pass before relying on this coverage.