Trust is the only currency that matters in software development, but hackers just spent it all on the Injective blockchain. A widely used software package was turned into a digital vacuum to suck out private keys and seed phrases.
Security firm Socket discovered on Thursday that a popular npm package used for building on Injective was maliciously modified. The tool, which sees roughly 50,000 weekly downloads, became a delivery system for malware. Socket researchers said the incident is significant for developers and applications handling Injective wallet workflows.
The attack targeted version 1.20.21 of the @injectivelabs/sdk-ts package. Hackers gained access through a compromised developer GitHub account, with suspicious commits starting on June 8. Socket reported the malicious code was pinned across 17 other packages in the Injective Labs npm scope, catching users who never installed the SDK directly.
The malware worked by hooking into key-derivation functions. Whenever an app generated a wallet key, the code secretly copied the seed phrase or private key. It then exfiltrated this data through fake telemetry to a web address mimicking a legitimate Injective network server. Socket warned that any keys passed through these packages should be treated as compromised.
The developer whose account was breached spotted the attack quickly, but the damage was done. Socket reported the malware was downloaded 310 times. Injective CEO Eric Chen said the issue is fixed and affected versions are now deprecated. He added that no funds on the network are at risk.
This breach highlights a shift in tactics. The Security Alliance (SEAL) reported in its second-quarter threat report that attackers now use legitimate platforms like GitHub, npm and Google to deliver payloads. SEAL noted that compromised systems are being used to push malicious code into company repositories, creating a chain of infection.
The risk is not theoretical. CertiK reported on Monday that wallet compromises were the most costly attack vector in the first half of 2026. This trend saw 33 incidents resulting in $444 million stolen. Other recent strikes include Axios npm releases in March and the TrapDoor campaign in May.
While Injective struggles with a dwindling user base, the attack proves that even shrinking ecosystems are prime targets. DefiLlama reported that total value locked on Injective shrank 88% from a mid-2024 peak of $71 million to current levels of $8.2 million. Developers must now audit every dependency before the next supply-chain breach hits this month.
