Poisoned Pipeline / Incidents / AS59
Compromised Injective SDK on npm
On 31 July 2026 Socket reported that the official Injective Protocol
JavaScript SDK on npm had been overwritten with a malicious version.
The poisoned package kept the public API so installs would succeed,
then harvested environment secrets and wallet material from developer
machines and CI. This is a compromised-legitimate-artifact case, not
a typosquat.
Mapped techniques
- T0121 Compromised legitimate artifact
- T0113 Compromised user account
- T0140 Harvest tokens from environment variables
- T0159 Malicious artifact execution
supply-chain poisoned official sdk
Official Injective SDK package overwritten on npm.
Maintainer/publish credentials used to ship the bad version.
Secrets and wallet material from developer and CI environments.
Payload ran on install / import while preserving the public API.