Skip to main content
AVOID.NET

Injective (npm SDK supply-chain attack)

avoid.net/injective-npm-sdk-supply-chain-attack→62/100·75% conf.
[✓ FACT-CHECKED]· reviewed once · last review 27 Aug 2026

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·63749b…WT8p
Submit evidence

Summary

On July 8, 2026, a compromised maintainer GitHub account was used to publish a backdoored version of @injectivelabs/sdk-ts and 17 related npm packages, disguising a wallet-key-stealing payload as SDK usage telemetry. The malicious code was live for approximately 49 minutes before being reverted; Injective Labs stated no funds on the network were at risk and no user losses were confirmed. This incident is a software supply-chain compromise affecting an official npm SDK maintained by Injective Labs — it did not involve a vulnerability or exploit of the Injective blockchain protocol itself.

Connected Entities

2 entities · 6 linked investigations
Organizations
□Injective (npm SDK supply-chain attack)
Protocols
⌂Injective Protocol79
Relationships
  • Injective (npm SDK supply-chain attack)→mentioned with→Injective Protocol(80%)
  • Injective Protocol→mentioned with→Injective (npm SDK supply-chain attack)(80%)
Also appears in
Injective Protocol·79Cosmos (ATOM)·42Wanchain-Cardano Bridge NIGHT Token Exploit (July 2026)·4Levana Perps·22Wanchain·50Spicenet·58

Connected Through

2 shared actors · 6 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Injective (npm SDK supply-chain attack)?
0
Accepted
1
Under review
0
Rejected / revoked

1 submission awaiting moderator review.

Timeline(5 events)

8 July 2026

Malicious commit adding the wallet-key-exfiltration payload, disguised as SDK usage-analytics telemetry, is pushed directly to the master branch of @injectivelabs/sdk-ts using a compromised maintainer account (approx. 20:24 UTC).

StepSecurity

8 July 2026

A version bump triggers automated CI publishing of version 1.20.21, which propagates the backdoor to 18 @injectivelabs-scoped npm packages within minutes (approx. 20:54–21:00 UTC).

StepSecurity

8 July 2026

A revert commit removes the malicious payload from the repository (approx. 21:16 UTC).

StepSecurity

8 July 2026

Clean version 1.20.23 is published across all 18 affected packages and version 1.20.21 is deprecated on the npm registry, ending the exposure window at roughly 49 minutes (approx. 21:47–21:49 UTC).

StepSecurity

9 July 2026

Security researchers and outlets including Socket, Ox Security, The Hacker News, and Bleeping Computer publish analyses of the attack; Injective Labs CEO Eric Chen states no network funds are at risk.

CryptoBriefing
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain6 Wayback Archives

Decision Log

  • #4reviewRecorded on Solana ✓10/21/2026, 2:19:02 AM
    slot 459459814 · hash 2PUtXTjhREkKA83Y4d3ieR6wXgo8Jot7wmw9kwMdVpRX
  • #3review approveRecorded on Solana ✓8/27/2026, 6:05:37 AM
    slot 443524220 · hash G1QW7eWav2385vMLwsuSMXniK2DC4fuBy31sjomsZrQz
  • #2reviewRecorded on Solana ✓8/27/2026, 6:05:37 AM
    slot 443524214 · hash AiiHgUNjL7kNXoXqpTYCLApNx3tzFGRYe1MrQyFdCxw3
  • #1publishRecorded on Solana ✓7/22/2026, 1:53:39 AM
    slot 443500949 · hash FZBVgLvR6ZxfzPfehfy4CaVbnaU3FqzGvYcaZzjftSYP

This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 6 of 6 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-10-2122 claims checked1 correction pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-code-investigator

generated: 7/22/2026, 1:50:11 AM

last updated: 8/27/2026, 6:05:37 AM

4 views

avoid.net — verified advice for a post-truth world