Injective says no funds at risk after npm packages backdoored to steal wallet keys

Injective has dismissed concerns that user funds were compromised after attackers planted wallet-key-stealing code in 18 of its official npm developer packages. 

Meanwhile, security firms warn that the attack exposed the private keys and seed phrases that passed through the software.

What happened to Injective? 

The attack on Injective started when two malicious code changes were pushed directly to the main code branch under the name “thomasRalee” who is a real developer that had previously contributed to the project. 

There was no code review or pull request, which is unusual, but this gap allowed the bad code to bypass security checks.

The malicious code, found by the security firm Socket, was hidden inside version 1.20.21 of @injectivelabs/sdk-ts, the TypeScript SDK that wallets, exchange front ends, and trading bots use to build on Injective. 

The attackers reportedly added a fake analytics file that hooked into PrivateKey.fromMnemonic() and PrivateKey.fromHex(), both of which are critical functions used to turn a user’s seed phrase or raw private key into a signing key for transactions.

The malicious function was named trackKeyDerivation(), and it claimed to collect user data for “SDK optimization,” but in reality, it stole the secret keys and seed phrases being passed through the software and sent them to a remote server. The server’s address was disguised to look like an official Injective domain, making it harder to detect.

The compromised version 1.20.21 was pinned across 17 other official @injectivelabspackages, meaning developers could be exposed even if they only used a related tool. 

Despite the fact that the bad packages were only available for less than one hour, the tainted release was downloaded more than 300 times. Normally, the SDK sees around 50,000 weekly downloads. Clean versions, labeled 1.20.23, were released to replace them.

Injective Labs addressed the incident directly in a post on X on Thursday, saying that the issue was identified and resolved immediately. 

“No funds were ever at risk, and no funds were compromised,” the Injective account wrote. The company’s CEO Eric Chen said separately that the affected npm releases had been deprecated and the problem fixed.

Socket said the campaign had not been fully contained at the time of its report, and did not say whether any assets were actually stolen.

How can users protect their wallets? 

Developers are advised to immediately upgrade to the clean version 1.20.23 or later to remove the malicious code. StepSecurity advised that anyone whose application pulled in the bad release, or a cached copy since, should treat the wallet secrets it touched as exposed and rotate them. 

Users are also advised to check package-lock.json or yarn.lock files for any reference to version 1.20.21, as other packages may have pulled it in automatically.

CertiK reported that wallet compromises account for $444.5 million stolen across 33 incidents in the first half of 2026.

If you're reading this, you’re already ahead. Stay there with our newsletter.