Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet private keys and mnemonic seed phrases.
Intelligence analysis by Llama
A malicious package was published on npm, compromising the Injective SDK project. The package stole cryptocurrency wallet private keys and mnemonic seed phrases, targeting developers building cryptocurrency wallets, trading bots, and decentralized exchanges.
Imagine you're building a computer program that helps people manage their money. Hackers found a way to sneak into the program's code and steal the secret keys that keep people's money safe. This is like a digital break-in, and it's very bad news for people who use these programs.
Analysis
A $60B Vote of Confidence
The Injective Labs SDK project, a TypeScript/JavaScript software development kit (SDK) for building applications on the Injective blockchain, has been compromised. Hackers gained access to the project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm). The package, version 1.20.21 of the @injectivelabs/sdk-ts, stole cryptocurrency wallet private keys and mnemonic seed phrases. This attack is a prime example of a supply-chain attack, where an attacker compromises a trusted third-party component to gain access to sensitive information.
The malicious package was downloaded 310 times before it was deprecated, not removed, and the malicious GitHub release artifacts are still available. The package has 87 direct dependencies on npm and very likely multiple additional transitive dependencies. A report from Ox Security warns that the 87 dependent packages had a cumulative download count of a little over 112,000.
The malware activates when the developers use SDK functions that generate or import wallet keys, rather than upon installation. Once those functions are called, the malware captures the full mnemonic seed phrase and private key and encodes the data in base64. All the information is exfiltrated via an HTTP POST request to an Injective Labs public infrastructure endpoint to make the traffic appear legitimate.
The attackers may then use the mnemonic or private key to port the victim’s wallets to their own devices and access, use, or transfer their digital assets. Developers who suspect compromise should transfer their cryptocurrency to new wallets and rotate all secrets in their environment.
Why Cursor?
The attackers compromised a GitHub account belonging to a legitimate project contributor and made the first suspicious commits on June 8, publishing the malicious version of the package shortly afterward. The attacker also published version 1.20.21 for another 17 packages associated with the project, pinning all of them to the compromised SDK version.
The Road Ahead
The legitimate account owner detected the compromise within minutes, reverted the changes, and published a clean release, version 1.20.23. However, developer systems fetching the malicious packages via an update or used them were likely compromised. The researchers also note that the package has 87 direct dependencies on npm and very likely multiple additional transitive dependencies.
Key points
- Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet private keys and mnemonic seed phrases.
- The malicious package was downloaded 310 times before it was deprecated, not removed, and the malicious GitHub release artifacts are still available.
- The package has 87 direct dependencies on npm and very likely multiple additional transitive dependencies.
- The malware activates when the developers use SDK functions that generate or import wallet keys, rather than upon installation.
- The attackers may use the stolen mnemonic or private key to port the victim’s wallets to their own devices and access, use, or transfer their digital assets.
If the developers of the Injective SDK can quickly identify and fix the vulnerability, it's possible that the damage can be contained and the stolen information can be recovered. Additionally, this incident may lead to increased security measures being implemented by the npm team and other package managers to prevent similar attacks in the future.
The attackers may have already accessed and stolen sensitive information from many developers who used the malicious package. It's also possible that the attackers may have set up a system to automatically steal information from developers who use the package in the future.
