---
id: 4592
title: "Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/compromised-injectivelabs-exfiltrates-keys"
published_at: "2026-07-09 00:00"
tags: ["supply-chain", "web3", "featured", "malware", "credential-theft", "npm", "crypto-wallet", "injectivelabs"]
phying_url: "https://phying.com/item/4592"
lang: en
---

# Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

## Summary

A malicious release of @injectivelabs/sdk-ts, an npm package that pulls around 50,000 weekly downloads, shipped code that records wallet mnemonics and private keys as they are derived and ships them to an attacker-controlled endpoint. The bad version, 1.20.21, was live on npm for under an hour on June 8, 2026 before the maintainer noticed and published a clean fix. In that window the attacker also republished the same 1.20.21 version number across 17 other packages in the @injectivelabs scope, each pinned to the poisoned SDK, so that projects depending on any of them would pull the stealer in transitively.

## Why it matters

A compromised SDK update exfiltrated wallet keys through fake telemetry, combining a software-supply-chain compromise with direct cryptocurrency-theft risk.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-07-09 00:00
- **Original:** https://www.aikido.dev/blog/compromised-injectivelabs-exfiltrates-keys
- **Phying News:** https://phying.com/item/4592