Supply‑Chain Attack on Injective SDK npm Package Steals Crypto Wallet Keys
What Happened — Hackers compromised a legitimate contributor’s GitHub account for the Injective Labs SDK and published a malicious version (v1.20.21) of the @injectivelabs/sdk‑ts npm package. The package exfiltrated cryptocurrency wallet private keys and mnemonic seed phrases when developers invoked SDK functions that generate or import keys. Approximately 310 downloads occurred before the package was deprecated and a clean release (v1.20.23) was issued.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how a third‑party component can become a vector for credential theft, directly testing the effectiveness of SOC 2 vendor‑management controls.
- Continuous monitoring of open‑source dependencies provides audit‑ready evidence that your organization is actively managing supply‑chain risk.
- Mapping this incident to the SOC 2 CC6.1 (System Operations) and CC7.1 (Risk Management) controls helps prove due diligence during an audit.
Who Is Affected
- Developers building DeFi wallets, trading bots, decentralized exchanges, and other blockchain‑based applications.
- Organizations that rely on npm packages for production code, especially those in fintech, crypto, and broader tech SaaS sectors.
Recommended Actions
- Inventory all third‑party packages (SBOM) and cross‑reference against a trusted vendor risk database.
- Enforce signed releases and automated integrity checks (e.g., npm’s
npm audit, SLSA provenance). - Implement continuous dependency monitoring and retain evidence of remediation for audit purposes.
Technical Notes – The malicious code activates on wallet‑key generation/import, captures the seed phrase and private key, encodes them in Base64, and exfiltrates via an HTTP POST to an Injective Labs endpoint. No CVE is associated; the vector is a supply‑chain compromise of a GitHub account. Source: BleepingComputer