Injective Labs SDK Compromise Leads to Malicious npm Package Stealing Crypto Wallet Keys
What Happened — Unknown threat actors breached the public GitHub repository for the Injective Labs SDK and published a malicious npm package (@injectivelabs/sdk‑ts@1.20.21). The package contains hidden telemetry that exfiltrates cryptocurrency wallet private keys and mnemonic seed phrases.
Why It Matters for Compliance & Audit Readiness
- A supply‑chain breach of a third‑party code library is a classic scenario SOC 2 controls are designed to detect, document, and remediate.
- Continuous vendor‑risk monitoring provides audit‑ready evidence that you vet, track, and enforce security standards on all external dependencies.
- Mapping this incident to SOC 2 CC6.1 (System Operations) and CC7.1 (Change Management) demonstrates due diligence and a defensible audit trail.
Who Is Affected — Blockchain developers, crypto‑wallet providers, and any organization that consumes the Injective Labs SDK (primarily TECH_SAAS and FIN_SERV sectors).
Recommended Actions
- Inventory all third‑party SDKs and npm packages in use; cross‑reference with a trusted Software Bill of Materials (SBOM).
- Enforce signed commits and mandatory 2FA on all critical repositories; enable GitHub Advanced Security alerts.
- Deploy a Software Composition Analysis (SCA) tool that continuously scans for malicious or tampered packages and logs findings as SOC 2 evidence.
- Update incident‑response playbooks to include supply‑chain compromise detection and reporting.
Source: The Hacker News
Technical Notes — The attack leveraged a compromised GitHub repo to push a malicious npm version. No CVE is associated; the vector is a third‑party dependency injection. Exfiltrated data includes private keys and mnemonic seed phrases from cryptocurrency wallets.