Topic starter
02/08/2026 9:48 am
TL;DR: A malicious npm release of @injectivelabs/sdk-ts captured wallet mnemonics and private keys during normal use, republished the poison across 17 related packages, and was downloaded 310 times before removal, according to Aikido. Supply chain trust breaks fastest when runtime secret handling is invisible to package review.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry”.
Key questions
Q: What breaks when wallet SDKs silently call secret-derivation code at runtime?
A: The main failure is that every wallet creation or load becomes a secret exposure event.
Q: Why do malicious dependencies create more risk than a simple package mismatch?
A: Because the danger is often in the execution path, not just the declared dependency tree.
Q: What are the signs that secret theft is hiding inside legitimate telemetry?
A: Look for code that collects values from derivation functions, encodes destinations at runtime, sends data in headers or service-like requests, and suppresses failures.
Practitioner guidance
- Review transitive dependencies that handle wallet secrets Trace resolved package trees for SDKs that derive mnemonics, private keys, tokens, or certificates, not just direct imports, and flag any package that can observe secret material at runtime.
- Quarantine and rotate exposed wallet material Assume any mnemonic or private key processed by a compromised package is exposed, then move funds, revoke dependent access, and replace the affected credentials with fresh ones.
- Separate secret processing from ordinary telemetry Require explicit approval for any library that emits metrics from secret-derivation code paths, and block outbound destinations that are not part of a documented trust list.
Bottom line: This compromise exposed wallet mnemonics and private keys through ordinary SDK calls, which means the attack succeeded inside a trusted runtime path rather than at install time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:39 pm
Runtime secret handling is the real trust boundary in modern supply chains: package approval alone does not govern what a dependency does after it is loaded. This case shows that wallet SDKs can exfiltrate secrets only when the application is already operating normally, which means build-time review misses the decisive control point. Practitioners should treat secret-bearing runtime paths as a separate governance domain.
A question worth separating out:
Q: How should teams respond when exposed wallet keys are discovered in a dependency incident?
A: Treat the secrets as compromised, move or protect the assets they control, revoke any access paths tied to them, and replace the affected keys or seed phrases. The response priority is containment of downstream use, not just removal of the package.
👉 Read our full editorial: Compromised Injective SDK exposes wallet keys through fake telemetry