Injective Labs npm Package Compromise Steals Crypto Keys

Malicious npm Package @injectivelabs/sdk-ts@1.20.21 Steals Crypto Wallet Keys via Compromised GitHub

Threat actors have executed a sophisticated Supply Chain Attack by compromising the Injective Labs SDK project’s GitHub repository. This breach led to the publication of a malicious version of the @injectivelabs/sdk-ts package, specifically 1.20.21, on the npm registry. This tainted package is designed to covertly exfiltrate cryptocurrency wallet private keys and mnemonic seed phrases from unsuspecting users, posing a critical risk to the broader Web3 ecosystem. According to The Hacker News, the malicious functionality was embedded as “fake telemetry,” enabling the surreptitious theft of sensitive wallet data.

This incident highlights the pervasive vulnerabilities within open-source software supply chains, where a compromise at any stage—from development environments to package registries—can have far-reaching implications. Developers who integrated @injectivelabs/sdk-ts@1.20.21 into their projects have inadvertently exposed their users to potential financial theft.

Technical Analysis of the Injective Labs SDK npm package compromise

The attack vector capitalized on a compromise of the legitimate Injective Labs SDK GitHub repository. While specific details regarding the initial breach method are not publicly disclosed, such compromises often stem from compromised developer credentials, weak access controls, or successful Phishing campaigns targeting project maintainers. Once access was gained, the attackers injected malicious code into the @injectivelabs/sdk-ts project.

This altered codebase was then pushed to the npm registry as version 1.20.21. The malicious payload was disguised as benign “telemetry functionality,” a common practice in software development for collecting usage statistics. However, in this instance, the “telemetry” was weaponized to scan for and transmit cryptocurrency wallet data, including private keys and mnemonic seed phrases, to an attacker-controlled C2 server. This demonstrates a clear intent for direct financial gain through the theft of digital assets. The exfiltration of mnemonic seed phrases is particularly severe, as these phrases can reconstruct an entire wallet and its associated funds, making comprehensive asset recovery extremely challenging once compromised.

The TTPs employed in this attack underscore a growing trend where adversaries target upstream components to maximize impact. By compromising a widely used SDK, attackers ensure that their malicious code is propagated across numerous downstream applications, amplifying their reach without needing to target each application individually. This strategy makes the task of detecting malicious npm packages challenging, as the compromised package initially appears legitimate and is distributed through official channels.

Mitigating Risk and Preventing Cryptocurrency Wallet Key Theft

For any organization or individual utilizing the Injective Labs SDK, immediate action is paramount. The primary recommendation is to identify and remove or downgrade any instances of @injectivelabs/sdk-ts@1.20.21. Organizations should conduct a thorough audit of their dependency trees to ensure no projects are inadvertently pulling this specific version.

Beyond immediate remediation, several strategic measures are crucial for preventing cryptocurrency wallet key theft and bolstering overall software supply chain security:

• Dependency Auditing and Pinning: Regularly audit all third-party dependencies. Use tools like npm audit and ensure that package versions are explicitly pinned in package.json or yarn.lock files to prevent automatic upgrades to potentially compromised versions. Consider using npm shrinkwrap or yarn.lock to lock down the exact dependency tree.
• Source Code Verification: Whenever possible, review critical open-source dependencies for unexpected changes or anomalies. Implement automated scanning tools for static application security testing (SAST) and software composition analysis (SCA) within CI/CD pipelines to detect suspicious code or outdated components.
• Enhanced Developer Account Security: Enforce strong authentication methods, including multi-factor authentication (MFA), for all developer accounts, especially those with access to source code repositories and package registries. Implement strict access controls and follow the principle of least privilege.
• Supply Chain Security Platforms: Leverage dedicated supply chain security platforms that monitor public repositories for suspicious activity, track dependency vulnerabilities, and provide integrity checks for published packages.
• Build Environment Hardening: Implement Zero Trust principles in build environments. Isolate build processes, restrict network access, and use immutable infrastructure to prevent persistent compromise of build systems.
• Endpoint Detection and Response (EDR) & Security Information and Event Management (SIEM): Deploy robust EDR solutions on developer workstations and build servers to monitor for unusual process execution or network connections indicative of compromise. Integrate logs into a SIEM for centralized monitoring and alert correlation.
• Developer Education: Educate developers on the risks of supply chain attacks, the importance of verifying package integrity, and best practices for securing their development environments and credentials.

This incident serves as a stark reminder that even seemingly trusted sources can be weaponized. Proactive monitoring, stringent security practices, and a culture of vigilance are essential to defend against evolving supply chain threats targeting the digital asset ecosystem.