Injective Labs npm SDK Compromised in Supply Chain Attack Targeting Crypto Wallets Attackers breached Injective Labs’ official source code repository, injecting malicious code into the company’s npm SDK packages a trusted developer toolkit used by blockchain and DeFi application builders on the Injective Protocol. The compromised packages, distributed through the legitimate repository, contained credential-stealing malware designed to exfiltrate cryptocurrency wallet seed phrases and private keys directly from developers’ environments. Unlike typosquatting or lookalike attacks, this was a repository-level compromise, meaning even developers who verified package authenticity checking publisher identity, download sources, and provenance unwittingly installed the tainted SDK. Standard supply chain security practices, such as confirming package origins, offered no protection, as the official source itself was compromised. The attack specifically targeted BIP-39 mnemonic seed phrases, which grant irreversible access to all wallet addresses derived from them. Once stolen, these phrases allow attackers to drain funds from every associated wallet, with no revocation mechanism available. The malware also sought private keys and credentials stored in developers’ environments, amplifying the risk for those working with production wallets. The Injective Protocol’s DeFi-focused ecosystem made its developers prime targets. Unlike traditional software development, DeFi builders often test integrations against live blockchains, requiring real wallet credentials in their environments. This operational reality meant the compromised SDK had access to high-value production wallets, not just test accounts with minimal balances. The incident highlights a critical gap in supply chain security: verifying package authenticity is insufficient when the official repository is breached. Previous attacks, such as fake Paysafe or Skrill SDK campaigns, relied on deception to trick developers into installing counterfeit packages. In contrast, the Injective breach exploited trust in the legitimate source, bypassing identity-based defenses entirely. Developers who installed or updated the affected npm packages during the compromise window were advised to treat all credentials in their environments as compromised. This included migrating funds to new wallets, rotating API keys, and auditing production systems for exposed credentials. Official disclosure materials from Injective Labs provided details on the affected packages, versions, and the exact exposure period.