Compromised Injective SDK npm package exposes private keys before being patched

A malicious update to the Injective SDK npm package was discovered, which attempted to steal wallet keys. This compromised version, identified as 1.20.21 of the @injectivelabs/sdk-ts package, was downloaded over 300 times before the issue was reported. Security firm Socket played a crucial role in uncovering the vulnerability, prompting Injective Labs to act swiftly.

Injective Labs announced that they had patched the vulnerability and claimed that no users were affected by the malicious package despite the significant number of downloads. The incident highlights the potential risks associated with software supply chains in the cryptocurrency space.

The incident occurred on July 10, 2026, when the malicious update was reported. The rapid response from Injective Labs, which included a patch for the vulnerability on the same day, reflects the urgency of addressing such security threats. The involvement of Socket, a security firm, emphasizes the importance of third-party oversight in identifying vulnerabilities.

This event serves as a critical reminder of the vulnerabilities present in software supply chains, particularly in the cryptocurrency sector. As digital assets become more prevalent, the need for enhanced security measures will only grow.

Looking ahead, the focus on securing npm packages and their associated security protocols is expected to intensify. Developers may face increased scrutiny regarding their security practices, leading to potential regulatory responses aimed at bolstering software supply chain security.

As the cryptocurrency landscape continues to evolve, it is imperative for developers and companies to adopt more robust security measures to safeguard user assets and sensitive data. This incident serves as a wake-up call for the industry to prioritize security in software development and distribution.