@Injectivelabs/[email protected] wallet-stealing package
Malware Activity
Summary
Hide ▲
Show ▼
The malicious @injectivelabs/[email protected] package is a wallet-stealing malware activity that can expose private keys and mnemonic seed phrases when library functions are used. The tainted release came from a compromised Injective Labs SDK GitHub repository and was published to npm on July 8, 2026. It also spread through 17 additional @injectivelabs packages that pinned the same version, expanding risk to transitive users. The package sent captured wallet derivation material to testnet.archival.chain.grpc-web.injective[.]network, making the release a direct supply-chain theft event.
Related Happenings
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
Campaign
H score8
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
CampaignAbout this happening: The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
AsyncAPI repositories and npm publishing workflow hit by network compromise
Incident
H score27
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
AsyncAPI repositories and npm publishing workflow hit by network compromise
IncidentAbout this happening: The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
Injective Labs SDK project GitHub repository hit by network compromise
Incident
H score21
First: 09.07.2026 23:10
Last: 09.07.2026 23:10
Sources 1
How related:
Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases.
About this happening:
The Injective Labs SDK project suffered a GitHub repository compromise that let attackers publish a malicious @injectivelabs/sdk-ts v1.20.21 package, putting developer...
Injective Labs SDK project GitHub repository hit by network compromise
IncidentHow related: Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases.
About this happening: The Injective Labs SDK project suffered a GitHub repository compromise that let attackers publish a malicious @injectivelabs/sdk-ts v1.20.21 package, putting developer...
Rollup polyfill npm package malware activity for remote access and data theft
Malware Activity
H score16
First: 03.07.2026 19:07
Last: 03.07.2026 19:07
Sources 1
About this happening:
Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Rollup polyfill npm package malware activity for remote access and data theft
Malware ActivityAbout this happening: Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Easy-day-js Mastra package-publishing campaign
Campaign
H score30
First: 17.06.2026 10:38
Last: 17.06.2026 10:38
Sources 1
About this happening:
The easy-day-js campaign mass-published more than 140 malicious npm packages across the @mastra/* namespace, creating broad supply-chain exposure for developers and bu...
Easy-day-js Mastra package-publishing campaign
CampaignAbout this happening: The easy-day-js campaign mass-published more than 140 malicious npm packages across the @mastra/* namespace, creating broad supply-chain exposure for developers and bu...
Timeline
-
10.07.2026 20:29 2 articles · 13d ago
Compromised Injective Labs SDK repository publishes @injectivelabs/[email protected]
Untyped PhaseUnknown threat actors compromised the Injective Labs SDK GitHub repository and used the trusted-publisher (OIDC) pipeline to publish @injectivelabs/[email protected] on npm with fake telemetry that exfiltrated cryptocurrency wallet private keys and mnemonic seed phrases. The same malicious version was also pinned across 17 additional @injectivelabs scoped packages, widening exposure for transitive users.
Show sources
- Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages — thehackernews.com — 10.07.2026 20:29
- Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages — thehackernews.com — 10.07.2026 20:29
-
10.07.2026 20:29 1 articles · 13d ago
Users are told to update to 1.20.23 and rotate exposed wallet keys
Initial DisclosureUsers who installed the malicious @injectivelabs/sdk-ts version were advised to update to the clean 1.20.23 release, treat any private key or mnemonic phrase processed through the package as compromised, rotate those credentials, and review transitive dependencies after the malicious npm release was deprecated.
Show sources
- Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages — thehackernews.com — 10.07.2026 20:29