Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor
ID: 66a32507-1a6c-5640-879e-ad64b9c0c636
STIX ID: report--66a32507-1a6c-5640-879e-ad64b9c0c636
Feed Name: Datadog Security Labs
Threat Score
On July 8, 2026 a malicious commit introduced an obfuscated telemetry module into @injectivelabs/sdk-ts v1.20.21 that hooks PrivateKey.fromMnemonic() and PrivateKey.fromHex() to capture full BIP-39 seed phrases and private keys, base64-encode them, and exfiltrate them in the X-Request-Id header to testnet.archival.chain.grpc-web.injective.network; the compromised package was published and available for ~49 minutes before a revert and clean release (1.20.23) were made.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.