Vulnerability MAL-2026-10165

@injectivelabs/[email protected] (published 2026-07-08 ~20:59 UTC) contains a wallet-credential stealer disguised as "key derivation telemetry". A file packages/sdk-ts/src/utils/key-derivation-telemetry.ts plus a hook added to packages/sdk-ts/src/core/accounts/PrivateKey.ts capture wallet secrets during key derivation:

• PrivateKey.fromMnemonic(words) forwards the full BIP-39 mnemonic to trackKeyDerivation('fm', words).
• PrivateKey.fromHex(privateKey) forwards a string-form hex private key to trackKeyDerivation('fh', privateKey) (a Uint8Array input sends the literal 'bytes' instead).

Captured values are queued, base64-encoded, and POSTed on a ~2s batch via fetch() (with a Node https fallback) to an endpoint built at runtime from a String.fromCharCode array, disguised as Content-Type: application/grpc-web+proto with the secret carried in the X-Request-Id header and keepalive:true. Classification: information stealer (mnemonic / private-key exfiltration). Trigger: runtime, on any call to PrivateKey.fromMnemonic() or PrivateKey.fromHex(string) — there is NO install script.

Malicious CODE is present only in @injectivelabs/sdk-ts. The other @injectivelabs/* packages published at 1.20.21 (utils, networks, ts-types, exceptions, and the wallet-* family) were version-bump-only and were deprecated by the maintainer as compromised; they depend on @injectivelabs/[email protected] and therefore deliver the payload transitively. Every affected package now carries the npm deprecation 'SECURITY: version 1.20.21 is compromised. Do not install.'

Introduced in git commits 01219285b16c / fd105db9073a / 5486f13e799d (direct, unsigned pushes to the master branch under a maintainer account). The release was built and published through the repository's GitHub Actions OIDC trusted-publishing workflow (.github/workflows/publish.yaml, event=push, run 28975012939), so 1.20.21 carries a VALID SLSA provenance attestation despite being malicious — provenance attests the build, not the intent. Reverted in commit 7c4b1a092 ('revert: exfiltration telemetry') and fixed in 1.20.23 (1.20.22 was never published). Root cause (how the maintainer account's write access was obtained) is undisclosed by the vendor.

Exfiltration endpoint: the char-code array decodes to https://testnet.archival.chain.grpc-web.injective.network/ , which resolves to an Injective testnet archival node (15.235.87.88, OVH; chain-id injective-888, moniker injective-testnet-archival) — i.e. Injective's OWN infrastructure, NOT attacker-operated infra. Whether the exfiltrated secrets were collectable by the attacker (e.g. via that node's request logs) is unconfirmed. Affected users must assume any mnemonic or private key used with 1.20.21 is compromised and rotate it from a clean machine.

Note: the community report at https://github.com/InjectiveLabs/injective-ts/issues/697 cites the endpoint as 'hexhole.injective.network'; that string does NOT appear in the shipped code and does not resolve. The code-derived endpoint above is authoritative. IoC: [email protected] tarball sha256 5348d2bb381c6abf2592e922920fca51cb9e0cc320c83d6270d83952e821e601.