Executive Summary
On July 8, 2026, a malicious actor successfully compromised the Injective blockchain ecosystem by injecting a backdoor into version 1.20.21 of the '@injectivelabs/sdk-ts' npm package. The malware was disguised as a telemetry module designed to collect SDK usage metrics but instead hooked critical key-derivation functions to steal BIP-39 mnemonic phrases and raw private keys. Analysis of the Git metadata suggests the compromise occurred via a developer account used from an anomalous UTC-4 timezone.
The malicious code was live on npm for approximately 49 minutes, during which it had the potential to exfiltrate secrets from any application loading a wallet using the SDK. The secrets were smuggled out through the 'X-Request-Id' HTTP header to a domain masquerading as a legitimate Injective testnet node. While the maintainer quickly reverted the changes and released a clean version (1.20.23), any credentials handled by version 1.20.21 must be considered fully compromised.