# Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

Malicious npm release of @injectivelabs/sdk-ts 1.20.21 hooked PrivateKey.fromMnemonic/fromHex to exfiltrate wallet mnemonics and private keys via disguised gRPC-web telemetry requests.

- Payout: Real-world hack
- Severity: critical
- Program: Injective Labs
- Analysis by: Aikido Security
- Disclosed: 2026-07-09
- Write-up quality: 7/10
- Original: https://www.aikido.dev/blog/compromised-injectivelabs-exfiltrates-keys
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-compromised-injectivelabs-exfiltrates-keys
- Tags: area:oss domain:oss impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:critical tech:nodejs technique:chained technique:source-review vuln:dependency-confusion vuln:secrets-leak

**Target:** npm package @injectivelabs/sdk-ts build artifacts (dist/cjs, dist/esm)
**Root cause:** Compromised maintainer GitHub account pushed commits injecting a fake 'key-derivation-telemetry' module into the SDK build, hooking PrivateKey.fromMnemonic and PrivateKey.fromHex to capture secrets before derivation.
**Steps:**
1. Attacker gains commit access to @injectivelabs/sdk-ts repo via account takeover
2. Inject block labeled src/utils/key-derivation-telemetry.ts into dist/cjs/accounts-Cy0p4lLW.cjs and dist/esm/accounts-jQ1GSgaW.js
3. Add hooks `trackKeyDerivation("fm", words)` in fromMnemonic and `trackKeyDerivation("fh", privateKey)` in fromHex
4. Store domain as char-code array, rebuild at runtime to `testnet.archival.chain.grpc-web.injective.network`
5. Debounce 2s, join queue with `|`, base64-encode, POST with header `X-Request-Id: <blob>` and `Content-Type: application/grpc-web+proto`
6. Publish 1.20.21 and republish 17 sibling @injectivelabs packages pinned to the poisoned SDK for transitive pull
7. Victim app derives key at runtime; secret exfiltrated silently (empty catch on failure)
**How found:** Maintainer noticed the malicious publish within ~20 minutes; Aikido analyzed by diffing 1.20.21 against clean 1.20.23, finding byte-identical files except one injected block and two one-line hooks, then decoded the char-code domain array and inspected the fetch/https exfil path.
**Exploitation:** Malicious package published to npm at 22:59 GMT+2 June 8 2026; any app deriving a wallet key via the SDK during normal use sent the mnemonic/hex key base64-encoded in an X-Request-Id header to an attacker-controlled lookalike gRPC-web subdomain. 310 downloads before revert at 23:18 and clean 1.20.23 at 23:48.
**Escalation:** Republished 17 sibling @injectivelabs packages (wallet-core, wallet-evm, wallet-ledger, etc.) each hard-pinning sdk-ts@1.20.21 so downstream projects pulled the stealer transitively without naming sdk-ts directly.
**Insight:** Install-time scanners miss payloads that trigger on runtime API calls like key derivation; diff published artifacts against the next clean release and grep for char-code array domain reconstruction and suspicious Content-Type spoofing (application/grpc-web+proto) with data in headers rather than body.