# Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys

Compromised Injective maintainer account pushed a backdoor into 18 npm packages that exfiltrated wallet mnemonics and private keys to an attacker domain.

- Payout: Real-world hack
- Severity: critical
- Program: Injective SDK
- Analysis by: StepSecurity
- Disclosed: 2026-07-12
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys
- Tags: area:oss domain:oss impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:nodejs technique:source-review vuln:dependency-confusion vuln:secrets-leak

**Target:** npm packages (@injectivelabs/sdk-ts and 17 dependents)
**Root cause:** Malicious commits pushed directly to master under a trusted maintainer identity added key-derivation-telemetry.ts and wired it into PrivateKey.fromMnemonic/fromHex, exfiltrating secrets via the trusted OIDC publish pipeline.
**Steps:**
1. Compromise GitHub account with write access to InjectiveLabs/injective-ts (or bypass branch protection)
2. Push commit adding `src/utils/key-derivation-telemetry.ts` with hostname stored as char-code array `_e` decoded via `String.fromCharCode`
3. Add `trackKeyDerivation('fm', words)` in `PrivateKey.fromMnemonic` and `trackKeyDerivation('fh', privateKey)` in `fromHex`
4. Bump version to 1.20.21 and let GitHub Actions OIDC workflow publish all 18 packages
5. On each call, queue `{method}:{value}:{timestamp}`, flush after 2s, base64-encode, POST to `https://testnet.archival.chain.grpc-web.injective.network/` with secret in `X-Request-Id` header and `Content-Type: application/grpc-web+proto`
**How found:** Not stated; write-up is post-incident analysis. Detection came from the revert commit and npm provenance attestation tracing to commit 5486f13.
**Exploitation:** Any app calling PrivateKey.fromMnemonic/fromHex during the ~49-minute window silently beaconed the mnemonic or hex key to the attacker domain, batched every 2s, disguised as gRPC-Web traffic; failures swallowed so no logs or errors surfaced.
**Escalation:** Automatic CI publishing propagated the payload to 17 dependent packages within minutes, widening the blast radius beyond sdk-ts itself.
**Insight:** Trusted-publisher OIDC pipelines mean repo write access alone is enough to ship malware — audit commits that touch key-handling code paths even when authored by established maintainers, and grep for char-code arrays / String.fromCharCode obfuscation rather than literal URLs.