CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

@injectivelabs/sdk-ts npm supply-chain compromise (2026)

incident · incident:injectivelabs-npm-sdk-ts-supply-chain-2026 single-source

GitHub-account-takeover-driven npm supply-chain compromise (2026-06-08, contained within ~50 minutes) of @injectivelabs/sdk-ts and 17 dependent scope packages, injecting a runtime-triggered wallet-key stealer with no install-time hook that hooks the SDK's key-derivation functions and exfiltrates disguised as normal gRPC-web API traffic; first public technical teardown by Aikido Security (2026-07-09).

Coverage
1
first 2026-07-10 → last 2026-07-10
Latest activity
2026-07-10
Aikido: compromised @injectivelabs npm package hooks key-derivation at runtime, carries no postinstall…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, finance, technology
Sources cited
1
1 hosts

Action items (3)

Do-now tasks recorded on the entries about @injectivelabs/sdk-ts npm supply-chain compromise (2026), newest first. Check the date before acting on an older one.

  • Do not treat a clean install-time (postinstall) scan as sufficient for npm dependencies; this payload had no lifecycle hook. Add build-artifact-vs-source diffing (compare the shipped dist/ output against the repository source) to catch code injected only into the compiled artifact.
    2026-07-10Aikido: compromised @injectivelabs npm package…
  • Audit transitive dependencies, not just direct ones: 17 of the 18 affected packages carried no malicious code of their own but pinned the poisoned SDK, so a project could pull the stealer without ever naming it. Pin exact versions and verify via build provenance/attestation (npm provenance, Sigstore) rather than trusting the registry alone.
    2026-07-10Aikido: compromised @injectivelabs npm package…
  • Add runtime egress monitoring for dependency processes making outbound calls to hosts that merely resemble a vendor's real API domain, and for unusual data carried in custom HTTP request headers rather than the body.
    2026-07-10Aikido: compromised @injectivelabs npm package…

Defender insights

What each entry about @injectivelabs/sdk-ts npm supply-chain compromise (2026) tells a defender to do, newest first.

2026-07-10NOTABLEAikido: compromised @injectivelabs npm package hooks key-derivation at runtime, carries no postinstall script, and exfiltrates disguised as normal SDK traffic

Story timeline

  1. 2026-07-10npm supply-chain payload hides as runtime 'telemetry' with no install hook, defeating install-time dependency scanners
    researchAikido: compromised @injectivelabs npm package hooks key-derivation at runtime, carries no postinstall script, and exfiltrates disguised as normal SDK traffic

Hunting pivots

Affected products
@injectivelabs/sdk-ts (npm)
Tags
cloudinfostealersupply-chain
ATT&CK techniques (4 across 5 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • Credential AccessInput Capture: Credential API Hooking
  • CollectionInput Capture: Credential API Hooking
  • Command and ControlData Encoding: Standard Encoding
  • ExfiltrationExfiltration Over C2 Channel

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-07-10/injectivelabs-npm-runtime-keyhook-supply-chain-evasion · ATT&CK page ↗

Credential Access TA0006

T1056.004Input Capture: Credential API Hooking×1

Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials.

Evidence: 2026-07-10/injectivelabs-npm-runtime-keyhook-supply-chain-evasion · ATT&CK page ↗

Collection TA0009

T1056.004Input Capture: Credential API Hooking×1

Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials.

Evidence: 2026-07-10/injectivelabs-npm-runtime-keyhook-supply-chain-evasion · ATT&CK page ↗

Command and Control TA0011

T1132.001Data Encoding: Standard Encoding×1

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME. Some data encoding systems may also result in data compression, such as gzip.

Evidence: 2026-07-10/injectivelabs-npm-runtime-keyhook-supply-chain-evasion · ATT&CK page ↗

Exfiltration TA0010

T1041Exfiltration Over C2 Channel×1

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Evidence: 2026-07-10/injectivelabs-npm-runtime-keyhook-supply-chain-evasion · ATT&CK page ↗

Entries about @injectivelabs/sdk-ts npm supply-chain compromise (2026) (1)

2026-07-10 · view entry permalink →

NOTABLENATOB2

npm supply-chain payload hides as runtime 'telemetry' with no install hook, defeating install-time dependency scanners

Aikido Security published (2026-07-09) a teardown of a compromised npm release of @injectivelabs/sdk-ts (an SDK pulling ~50,000 weekly downloads) that is notable less for its payload's purpose than for how it hid (Aikido Security, 2026-07-09). Introduced via what Aikido assesses as a GitHub account takeover (commits from an account with an established history), the malicious version was live for under an hour on 2026-06-08 before the maintainer reverted it, but in that window the attacker also republished the same version number across 17 other packages in the scope, each pinning the poisoned SDK, so any project depending on one of them resolved the stealer transitively without naming it directly.

The payload runs no install-time script. Diffed against the clean build, the artifacts differ by one injected block and two one-line hooks placed inside the SDK's own key-derivation entry points; each hook "fires before the real derivation runs, so the secret is captured on every legitimate call" during normal application use (Aikido, 2026-07-09). Because "the trigger is key derivation at runtime and not a lifecycle script, install-time scanners and sandboxes that only watch postinstall see a clean package", the single most important detail for defenders, since it defeats the exact control (install-hook / postinstall inspection) that most software-composition-analysis programmes lean on. The exfiltration was built to blend in: the destination host was stored as an array of character codes and reassembled at runtime to defeat plaintext string search, the captured material was base64-batched and sent inside an HTTP request header (not the body) with a content type matching the SDK's own gRPC-web API calls, and every failure path swallowed errors silently. The injected block was even documented in its own comment as "anonymized usage metrics for SDK optimization".

Because the trigger is key derivation at runtime and not a lifecycle script, install-time scanners and sandboxes that only watch postinstall see a clean package.

Each hook fires before the real derivation runs, so the secret is captured on every legitimate call

The malicious 1.20.21was published at 22:59 GMT+2 on June 8, 2026, the maintainer reverted the change at 23:18, and a clean version was published at 23:48.

Aikido Security 2026-07-09
research10 Jul 12:53Zsingle-sourceOpen finding →
Sources: Aikido Security

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Research1

Source distribution

  • aikido.dev1 (100%)
All cited sources (1)