Attackers Backdoored Injective SDK on npm to Steal Crypto Wallet Keys

Why It Matters for Developers

Security researchers at Socket, cited by Cointelegraph, said the incident carries particular weight for developers and applications that manage Injective wallet workflows. Teams that integrated the affected SDK into their build or runtime processes are the primary population at risk, since the malicious code operated within the developer toolchain rather than through a user-facing exploit.

Supply-chain incidents of this kind have become a recurring theme in software security. Rather than attacking a target directly, adversaries compromise a trusted dependency, allowing malicious code to reach a broad set of victims who installed what they believed to be legitimate software. The reliance of crypto applications on shared open-source libraries makes such tooling an attractive target for actors seeking to intercept wallet credentials.

Broader Context

For the Africa–Europe technology corridor, where a growing number of startups and engineering teams build on shared open-source crypto infrastructure, the episode underscores the importance of verifying package integrity and monitoring dependencies for unexpected changes.

The sources reviewed did not specify the total number of affected downloads, the identity of the attackers, or the full scope of any losses. Standard mitigation guidance in such cases includes auditing recently installed package versions, rotating any potentially exposed keys, and moving assets held in affected wallets to secure alternatives. Developers using the Injective SDK are advised to confirm they are running a verified, uncompromised release.