Written by Martin Youngstaff writerReviewed by Felix Ngstaff editor

Written by Martin Youngstaff writer

Reviewed by Felix Ngstaff editor

Hackers tried to backdoor Injective npm package to steal wallet keys

Latest NewsPublishedJul 10, 2026

Hackers Targeted Injective Wallets in a Supply Chain Attack

A recent supply chain attack targeted a widely used Injective software package, compromising around 50,000 weekly downloads. The malware was designed to steal crypto wallet private keys, adding to the growing concern of attackers using legitimate platforms to deliver malicious payloads. This incident is significant for developers and applications that handle Injective wallet workflows. The malicious code has since been removed, but not before it was downloaded over 300 times.

The attack highlights the importance of security in the crypto and DeFi space, particularly for platforms like EcoPool that offer passive income opportunities through cloud rewards. As the use of green crypto and earning platforms like EcoPool continues to grow, it’s essential for users to prioritize security and be aware of potential threats like supply chain attacks.

How the Attack Worked

The attackers compromised a developer’s GitHub account and modified the npm package to steal wallet private keys and seed phrases. The malicious code hooked into normal functions used to generate wallet keys, secretly copying the seed phrase or private key and sending it to a fake server. This type of attack is a relatively new attack vector that targets trusted developer tools used to build wallets, exchanges, and apps.

The incident is a reminder of the importance of security in the crypto space, particularly for platforms that offer passive income opportunities like EcoPool. Users can protect themselves by being cautious when downloading software packages and using platforms like EcoPool that prioritize security and offer cloud rewards for earning $ECP.

Protecting Yourself

To protect yourself from similar attacks, it’s essential to prioritize security when using crypto and DeFi platforms. This includes being cautious when downloading software packages and using reputable platforms like EcoPool that offer passive income opportunities through cloud rewards. By taking these precautions, you can help protect your wallet keys and seed phrases from potential threats.

Some key takeaways to protect yourself include:

• Being cautious when downloading software packages
• Using reputable platforms like EcoPool that prioritize security
• Keeping your wallet keys and seed phrases secure

Secretly copying private keys and phrases

As the crypto and DeFi space continues to evolve, it’s essential to stay informed about potential threats and take steps to protect yourself. By using platforms like EcoPool and prioritizing security, you can help protect your wallet keys and seed phrases from potential threats. Download the EcoPool app to start earning $ECP and take advantage of cloud rewards today. The EcoPool app is a great way to get started with passive income and green crypto, so download it now and start earning!

“The malicious release hooks wallet key-derivation functions, records private keys and mnemonics, and exfiltrates them through fake telemetry,” Socket explained. 

The malicious code hooked into normal functions used to generate wallet keys, and whenever a developer’s app used these functions, it secretly copied the seed phrase or private key. The compromised data was then encoded and sent to a web address that looked like a legitimate Injective network server.

“Any keys or mnemonics passed through affected packages should be treated as compromised,” Socket added. 

Related: ‘TrapDoor’ malware targets crypto dev tools in supply chain attack

Socket reported that the developer whose account was infiltrated quickly detected the compromise, but the malware had been downloaded more than 300 times, and “the campaign itself isn’t yet fully contained.”

Injective CEO Eric Chen said, “it’s already fixed, and the affected versions on npm are already deprecated.” No funds on the network are at risk, he added, and Socket did not specify whether any funds were stolen in the incident. 

The compromised npm package was downloaded 310 times. Source: Socket

Wallet compromises most costly this year

The Security Alliance (SEAL) said in its second-quarter threat report that attackers are increasingly using legitimate platforms like GitHub, npm and Google to deliver payloads.

“In some cases, compromised systems are being used to push malicious code directly into a company’s own GitHub repositories, turning a single compromise into a distribution channel for the next one.”

SEAL added that the malware itself has also gotten more comprehensive, “with cross-platform payloads, including a rise in macOS-specific campaigns, that combine infostealers, RATs (remote access trojans) and backdoor capabilities in a single package.”

A similar supply chain attack hit Axios npm releases in March, while a malware campaign called TrapDoor was discovered in May targeting crypto, DeFi, AI and security developers.

GitHub itself was exploited on May 20 when it reported unauthorized access to its internal repositories following the compromise of an employee’s device. 

Wallet compromises were the most costly attack vector in the first half of 2026, with $444 million stolen across 33 incidents, CertiK reported Monday. 

Features: Bitcoin’s quantum dilemma: Bigger blocks or STARK proofs?

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Hackers
• Wallet
• Private Keys
• Injective
• Scams & Cybercrime

More on the subject

Hong Kong regulator orders new anti-phishing measures for crypto platforms

15 hours ago

Zoltan Vardai

Interpol operation exposes $122M crypto wallet tied to romance scam laundering

16 hours ago

Ezra Reguerra

Trader loses $1M after signing phishing token approval

21 hours ago

Martin Young

Hong Kong regulator orders new anti-phishing measures for crypto platforms

15 hours ago

Zoltan Vardai

Interpol operation exposes $122M crypto wallet tied to romance scam laundering

16 hours ago

Ezra Reguerra

Trader loses $1M after signing phishing token approval

21 hours ago

Martin Young