type: incident · created: 2026-07-11 · updated: 2026-07-11 · tags: [incident, supply-chain, campaign] · confidence: high · affected_sectors: [technology, finance] · au_impact: false
Injective Labs Supply Chain Attack
Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and published a malicious npm package designed to steal cryptocurrency wallet private keys and mnemonic seed phrases.
Attack Details
- Target: Injective Labs SDK (
@injectivelabs/sdk-ts) - Malicious version: 1.20.21
- Method: Compromised developer account → GitHub commit
- Payload: Steals cryptocurrency wallet private keys and mnemonic seed phrases
- Spread: Tainted version published across 17 additional @injective packages
- Discovered by: Socket security research
Response
- Malicious package deprecated on npm
- Remains downloadable from GitHub — users who pulled the package should rotate keys immediately (raw/digests/Cyber-Digest-2026-07-11.md)
Significance
This attack highlights the ongoing risk of compromised developer accounts in the npm/GitHub supply chain. Unlike dependency confusion or typo-squatting, this was a direct compromise of a legitimate maintainer's account — the most dangerous form of supply chain attack.
Related Pages
- Wp Shellstorm — Webshell supply chain (WordPress)
- Hallusquatting — AI-assisted supply chain attack
- npm-12-sandbox — npm defensive improvements