# Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor

Malicious npm release of @injectivelabs/sdk-ts hooked PrivateKey.fromMnemonic/fromHex to exfiltrate seed phrases and private keys via the X-Request-Id header to a spoofed Injective domain.

- Payout: Real-world hack
- Severity: critical
- Program: Injective SDK
- Credited: Datadog Security Labs
- Disclosed: 2026-07-09
- Write-up quality: 8/10
- Original: https://securitylabs.datadoghq.com/articles/not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor/
- Library page: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor
- Tags: domain:web3 impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:critical tech:nodejs technique:reverse-engineering technique:source-review vuln:secrets-leak

**Target:** npm package @injectivelabs/sdk-ts (TypeScript blockchain SDK)
**Root cause:** A malicious commit pushed to master added an obfuscated 'telemetry' module that hooked PrivateKey.fromMnemonic() and fromHex() to capture raw mnemonics/private keys and POST them base64-encoded in the X-Request-Id header to a lookalike domain.
**Steps:**
1. Identify malicious commit 0121928 adding packages/sdk-ts/src/core/accounts/PrivateKey.ts with obfuscated char-code array `_e`
2. Deobfuscate `_e.map(x=>String.fromCharCode(x)).join('')` to `testnet.archival.chain.grpc-web.injective.network`
3. Observe `trackKeyDerivation(method,value)` pushes `${method}:${value}:${Date.now()}` to queue `_q`
4. Observe `_send(d)` POSTs to `_ep` with header `X-Request-Id: d` and content-type `application/grpc-web+proto`
5. Note hooks: `trackKeyDerivation('fm', words)` in fromMnemonic and `trackKeyDerivation('fh', privateKey)` in fromHex
6. Confirm affected npm version 1.20.21; test endpoint with base64 payload in X-Request-Id
**How found:** Researchers noticed an abnormal direct-to-master commit with obfuscated code disguised as telemetry, then reverse-engineered the char-code array to reveal the real exfil domain differing from the one reported in the GitHub issue.
**Exploitation:** Attacker with maintainer-level repo access pushed obfuscated code to master, survived CI lint failures with follow-up formatting commits, and released npm 1.20.21. Any developer loading a wallet via fromMnemonic/fromHex sent the raw seed phrase or private key string to the attacker's endpoint, granting full control of derived keys/addresses.
**Escalation:** Full mnemonic capture yields permanent control over every key and address derivable from the seed, enabling total wallet/funds compromise across the ecosystem.
**Insight:** Obfuscated char-code arrays in 'telemetry' code are a red flag; always deobfuscate string construction rather than trusting the reported C2 domain, and check git commit timezone offsets for anomalies indicating compromised maintainer credentials.