Crypto-wallet stealer planted in Injective SDK npm package

Hackers have compromised the GitHub repository of the Injective Labs SDK project and used it to publish a malicious package to the Node Package Manager (npm) registry.

The malicious code was embedded in an outwardly legitimate package and was designed to steal the private keys and mnemonic seed phrases of cryptocurrency wallets from developers who install the dependency via npm.

What we know

The Injective Labs SDK is used by developers building applications that interact with the Injective blockchain platform. Having gained access to the project's GitHub repository, the attackers were able to inject malicious functionality into the package and distribute it through the official npm channel, which made developers more likely to trust the download.

The stealer targeted crypto-wallet data — private keys and seed phrases — possession of which grants full control over the victim's funds.

Context

Software supply-chain compromise attacks, in which attackers inject malicious code into popular packages hosted by dependency managers such as npm, remain one of the common attack vectors against developers and the cryptocurrency industry.

Source: Bleeping Computer