Injective npm Package Maliciously Modified
Security company Socket discovered that the Injective blockchain @injectivelabs/sdk-ts npm package was maliciously tampered with.
Attackers compromised the developer's GitHub account to implant code that steals wallet private keys and mnemonic phrases, encoding the data and sending it to a disguised server. The package has approximately 50,000 weekly downloads, with the malicious version 1.20.21 appearing on June 8.
Injective CEO Eric Chen stated that the issue has been resolved, the affected version has been deprecated, and network funds are safe. However, the malicious package has been downloaded over 310 times and has locked 17 other packages. Socket warns that the attack has not been fully contained.
Source: Public Information
ABAB AI Insight
Injective Labs previously relied on the npm supply chain as a DeFi project within the Cosmos ecosystem. This attack is similar to several GitHub credential leak incidents in the 2020s (such as the xz utils backdoor), where attackers achieved supply chain contamination through developer accounts, exposing a lack of security awareness among open-source maintainers.
In terms of capital pathways, attackers targeted high-download SDKs to steal user assets, with resources shifting towards automated supply chain scanning and security tools. The Injective team responded quickly by deprecating the version, motivated by the need to maintain ecosystem trust and prevent capital outflow and reputational damage.
Similar to the 2024 SolarWinds incident or recent npm events, blockchain projects currently face a high-risk phase of ongoing supply chain attacks while relying on the JavaScript ecosystem, with high-end DeFi protocols being particularly vulnerable.
This essentially reflects an industrial chain reconstruction under technological substitution: open-source npm packages have become attack vectors, with the mechanism being weak protection of developer accounts and the amplification of impact through dependency propagation. Capital is shifting from pure protocol development to supply chain security and auditing, with pricing power moving from rapidly iterating projects to mature ecosystems with security barriers.
ABAB News · Cognitive Laws
The weakest link in the supply chain determines the security of the entire chain.
The larger the download volume, the broader the attack surface.
Quick fixes are urgent, but prevention of intrusions is fundamental.