The npm Package That Only Turned Evil When You Used It
Published on gastropod.io - 07-15-2026
Injective sdk ts npm backdoor
Most npm supply chain writeups this year have followed the same shape: a bad postinstall script, a curl | bash, a script that fires the second you type npm install and is gone before you've had coffee. Useful to know, easy to defend against — that's exactly why npm install --ignore-scripts became the reflexive advice for anyone nervous about the ecosystem.
The @injectivelabs/sdk-ts compromise on July 8th didn't care about any of that, and that's what makes it worth sitting with.
sdk-ts is the official TypeScript SDK for Injective, a blockchain built for finance — the library developers reach for to query on-chain data, build transactions, and generate or import wallet keys. On July 8th, someone with legitimate write access to the project's GitHub repo pushed two commits straight to master, no pull request, no review. One added a new file dressed up as an innocuous analytics helper — a JSDoc comment described it as "anonymized usage metrics for SDK optimization." Underneath that comment sat an obfuscated character array that decoded to a URL crafted to look like Injective's own testnet infrastructure.
The payload hooked directly into PrivateKey.fromMnemonic() and PrivateKey.fromHex() — the two functions that run every time a wallet is created or loaded. The moment either fired, the full seed phrase or private key got base64-encoded and smuggled out inside an X-Request-Id HTTP header, riding along on what looked like a routine API call. No install script. No suspicious network call at build time. Just ordinary-looking traffic, waiting for someone to actually use the SDK the way it's meant to be used.
It stayed live for about 49 minutes before the same maintainer whose account had been used caught it and shipped a clean version. In that window it was downloaded 310 times — and, in a move that's becoming a signature of these campaigns, the attacker also pushed the same malicious version number across 17 other packages in the @injectivelabs scope that pin sdk-ts as a dependency. Pull any one of those, and you got the backdoor without sdk-ts ever showing up by name in your own package.json. Researchers at Datadog, who published the first detailed technical teardown, estimate the combined blast radius touched somewhere north of 87 downstream packages.
What sticks with us isn't the seed-phrase theft itself — crypto SDKs get targeted constantly. It's that the entire premise of "block install scripts and you're safe" quietly stopped being true for anyone running this package. Runtime-triggered payloads that only activate on real function calls sail straight past the defense most teams adopted this year. And the propagation trick — same bad version stamped across a whole scope of pinned packages — means the question "did we pull the compromised package" can't be answered by grepping one package.json. It has to be answered across every service, every lockfile, every transitive path, for a version string that might be sitting three dependencies deep in something your team never chose directly.
That's the part that's genuinely hard to do by hand under time pressure, and it's the part we built gastropod around. Every artifact that's ever passed through the registry keeps its where-seen history and its blast-radius graph — direct and transitive — attached to its identity, not re-derived per project. When a version like 1.20.21 turns out to be poisoned, the question isn't "let's kick off a fleet-wide rescan and see what turns up in a few hours." It's one lookup against artifact identity, and you have the full list of consumers — who pulled it, from where, when — before you've finished reading the advisory. We wrote a bit about how that blast-radius view works in practice on the product page, if you're curious what it looks like on a real package.
For teams downstream of @injectivelabs, the guidance from here is the same as everywhere else in this genre of incident: upgrade to 1.20.23 or later, treat any key or mnemonic that ever passed through the affected window as burned, move funds, rotate everything. The technical writeups worth reading in full are Datadog Security Labs' teardown of the backdoor and The Hacker News' summary of the disclosure, both of which go deeper into the exfiltration mechanics than we have room for here.