@INJECTIVELABS/SDK-TS · GHSA-gh3v-q63w-chr5 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Jul 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
@injectivelabs/sdk-ts@1.20.21 (published 2026-07-08 ~20:59 UTC) contains a wallet-credential stealer disguised as "key derivation telemetry". A file packages/sdk-ts/src/utils/key-derivation-telemetry.ts plus a hook added to packages/sdk-ts/src/core/accounts/PrivateKey.ts capture wallet secrets during key derivation:
Captured values are queued, base64-encoded, and POSTed on a ~2s batch via fetch() (with a Node https fallback) to an endpoint built at runtime from a String.fromCharCode array, disguised as Content-Type: application/grpc-web+proto with the secret carried in the X-Request-Id header and keepalive:true. Classification: information stealer (mnemonic / private-key exfiltration). Trigger: runtime, on any call to PrivateKey.fromMnemonic() or PrivateKey.fromHex(string) — there is NO install script.
Malicious CODE is present only in @injectivelabs/sdk-ts. The other @injectivelabs/* packages published at 1.20.21 (utils, networks, ts-types, exceptions, and the wallet-* family) were version-bump-only and were deprecated by the maintainer as compromised; they depend on @injectivelabs/sdk-ts@1.20.21 and therefore deliver the payload transitively. Every affected package now carries the npm deprecation 'SECURITY: version 1.20.21 is compromised. Do not install.'
Introduced in git commits 01219285b16c / fd105db9073a / 5486f13e799d (direct, unsigned pushes to the master branch under a maintainer account). The release was built and published through the repository's GitHub Actions OIDC trusted-publishing workflow (.github/workflows/publish.yaml, event=push, run 28975012939), so 1.20.21 carries a VALID SLSA provenance attestation despite being malicious — provenance attests the build, not the intent. Reverted in commit 7c4b1a092 ('revert: exfiltration telemetry') and fixed in 1.20.23 (1.20.22 was never published). Root cause (how the maintainer account's write access was obtained) is undisclosed by the vendor.
Exfiltration endpoint: the char-code array decodes to , which resolves to an Injective testnet archival node (15.235.87.88, OVH; chain-id injective-888, moniker injective-testnet-archival) — i.e. Injective's OWN infrastructure, NOT attacker-operated infra. Whether the exfiltrated secrets were collectable by the attacker (e.g. via that node's request logs) is unconfirmed. Affected users must assume any mnemonic or private key used with 1.20.21 is compromised and rotate it from a clean machine.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Note: the community report at https://github.com/InjectiveLabs/injective-ts/issues/697 cites the endpoint as 'hexhole.injective.network'; that string does NOT appear in the shipped code and does not resolve. The code-derived endpoint above is authoritative. IoC: sdk-ts@1.20.21 tarball sha256 5348d2bb381c6abf2592e922920fca51cb9e0cc320c83d6270d83952e821e601.
-= Per source details. Do not edit below this line.=-
The wallet/accounts module (dist/esm/accounts-jQ1GSgaW.js) contains injected code that reconstructs a remote host from a char-code array via String.fromCharCode, decoding to testnet.archival.chain.grpc-web.injective.network, and builds the endpoint https://<host>/. When a wallet is created or used, the code reads the BIP-39 mnemonic (via @scure/bip39 generateMnemonic and ethers HDNodeWallet) and POSTs it base64-encoded, placed in an X-Request-Id header with an application/grpc-web+proto content-type, to that endpoint, with a Node http fallback. The char-code obfuscation of the host and the grpc-web framing disguise the exfiltration as normal Injective SDK traffic. Any mnemonic handled by this version is transmitted to the operator of that host, exposing the wallet's master key.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.