The compromise of the Injective Labs SDK on npm highlights the serious risk of software supply-chain attacks in cryptocurrency and Web3 development.

Attackers compromised the project’s GitHub repository and used it to publish a malicious npm package that targeted cryptocurrency wallet private keys and mnemonic seed phrases. This is especially dangerous because private keys and seed phrases are not ordinary credentials. Once stolen, they can give attackers direct control over wallets and funds, usually with no practical recovery path.

Developers working with blockchain SDKs often run code in environments that contain wallet material, API tokens, signing keys, deployment secrets, and access to smart-contract infrastructure. A compromised dependency in that environment can therefore move quickly from “library issue” to financial loss.

Organizations should immediately identify whether affected Injective SDK versions were installed, remove malicious versions, rotate exposed secrets, and move any at-risk funds to new wallets generated from clean environments. Systems used for wallet signing or deployment should also be reviewed for additional persistence or credential theft.

Development and CI/CD environments should not store long-lived wallet secrets unless absolutely necessary. Where signing is required, teams should use hardware wallets, isolated signing systems, strict dependency pinning, package integrity checks, and approval workflows for dependency updates.

The key lesson is that in crypto, a stolen seed phrase is not a password reset problem. It is ownership transfer with extra steps and worse customer support. Supply-chain security must be treated as financial security, because attackers certainly do.

Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet private keys and mnemonic seed phrases. [...]

Source: Injective SDK on npm infected with cryptocurrency wallet stealer via Bleeping Computer — published 09 Jul 2026.