Injective Labs GitHub Compromise: Detecting and Blocking Malicious npm Packages Targeting Crypto Wallets

---
title: Suspicious npm Package Installation from Injective Labs
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects installation of potentially compromised npm packages from Injective Labs following the GitHub compromise.
references:
  - https://thehackernews.com/2026/07/injective-labs-github-compromise-pushes.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\npm.cmd'
    CommandLine|contains:
      - '@injective-protocol'
      - 'injective-labs'
  condition: selection
falsepositives:
  - Legitimate installations of Injective Labs packages (verify versions)
level: high
---
title: Cryptocurrency Wallet Key Exfiltration via Node.js Process
id: b2c3d4e5-f6a7-8901-2345-678901bcdef
status: experimental
description: Detects Node.js processes attempting to send wallet key data to external endpoints.
references:
  - https://thehackernews.com/2026/07/injective-labs-github-compromise-pushes.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.credential_access
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    DestinationPort:
      - 80
      - 443
      - 8080
  filter:
    DestinationHostname|contains:
      - 'github.com'
      - 'npmjs.com'
      - 'npm.pkg.github.com'
  condition: selection and not filter
falsepositives:
  - Legitimate Node.js network activity
level: medium

// Detect installation of potentially compromised npm packages
DeviceProcessEvents
| where ProcessName =~ "npm.cmd"
| where ProcessCommandLine has "@injective-protocol" or ProcessCommandLine has "injective-labs"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Detect potential wallet key exfiltration from Node.js processes
DeviceNetworkEvents
| where ProcessName =~ "node.exe"
| where RemotePort in (80, 443, 8080)
| where RemoteUrl !contains "github.com" and RemoteUrl !contains "npmjs.com" and RemoteUrl !contains "npm.pkg.github.com"
| project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for potentially compromised npm packages
SELECT * FROM glob(globs='*/node_modules/@injective-protocol/*/package.')
WHERE 
  -- Check for recent modifications
  Mtime > timestamp(now="-7d")
  OR
  -- Check for suspicious package versions
  Content =~ "wallet" OR Content =~ "key" OR Content =~ "seed"

-- Hunt for npm install commands involving Injective Labs packages
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "node.exe" 
  AND (CommandLine =~ "@injective-protocol" OR CommandLine =~ "injective-labs")

# Audit and remediate potentially compromised npm packages
# This script checks for and removes packages from Injective Labs released during the compromise period

function Check-InjectivePackages {
    param(
        [string]$ProjectPath
    )
    
    if (-not (Test-Path $ProjectPath)) {
        Write-Error "Path not found: $ProjectPath"
        return
    }

    $packageJsonPath = Join-Path $ProjectPath "package."
    
    if (Test-Path $packageJsonPath) {
        $packageJson = Get-Content $packageJsonPath | ConvertFrom-Json
        
        # Check dependencies and devDependencies for Injective packages
        $dependencies = @{}
        
        if ($packageJson.PSObject.Properties['dependencies']) {
            $packageJson.dependencies.PSObject.Properties | ForEach-Object { 
                $dependencies[$_.Name] = $_.Value 
            }
        }
        
        if ($packageJson.PSObject.Properties['devDependencies']) {
            $packageJson.devDependencies.PSObject.Properties | ForEach-Object { 
                $dependencies[$_.Name] = $_.Value 
            }
        }
        
        # Check for Injective Labs packages
        $injectivePackages = $dependencies.Keys | Where-Object { 
            $_ -like "*injective*" -or $_ -like "*@injective*" 
        }
        
        if ($injectivePackages) {
            Write-Host "Found Injective Labs packages in $ProjectPath:" -ForegroundColor Yellow
            foreach ($package in $injectivePackages) {
                Write-Host "  - $package : $($dependencies[$package])" -ForegroundColor Yellow
            }
            
            return $injectivePackages
        }
    }
    
    return @()
}

# Scan current directory and subdirectories
$currentPath = Get-Location
$projects = Get-ChildItem -Path $currentPath -Directory -Recurse | 
            Where-Object { Test-Path (Join-Path $_.FullName "package.") }

$totalProjects = 0
$affectedProjects = 0

foreach ($project in $projects) {
    $totalProjects++
    $packages = Check-InjectivePackages -ProjectPath $project.FullName
    
    if ($packages.Count -gt 0) {
        $affectedProjects++
        
        Write-Host "\nPotentially compromised packages found in: $($project.FullName)" -ForegroundColor Red
        
        # Ask for confirmation before removing packages
        $response = Read-Host "Do you want to remove these packages? (Y/N)"
        
        if ($response -eq "Y" -or $response -eq "y") {
            Set-Location $project.FullName
            
            foreach ($package in $packages) {
                Write-Host "Removing package: $package" -ForegroundColor Cyan
                npm uninstall $package
            }
            
            # Reinstall with latest verified versions
            $reinstall = Read-Host "Do you want to reinstall the packages with the latest verified versions? (Y/N)"
            
            if ($reinstall -eq "Y" -or $reinstall -eq "y") {
                foreach ($package in $packages) {
                    Write-Host "Installing latest verified version of: $package" -ForegroundColor Cyan
                    npm install $package@latest
                }
            }
            
            Set-Location $currentPath
        }
    }
}

Write-Host "\nScan complete. Scanned $totalProjects projects. Found issues in $affectedProjects projects." -ForegroundColor Green

# Additional hardening recommendations
Write-Host "\nAdditional hardening recommendations:" -ForegroundColor Cyan
Write-Host "1. Enable npm audit in your CI/CD pipeline" -ForegroundColor White
Write-Host "2. Implement package lock files (package-lock.) to ensure reproducible builds" -ForegroundColor White
Write-Host "3. Use npm's --ignore-scripts flag when installing packages from untrusted sources" -ForegroundColor White
Write-Host "4. Implement SLSA provenance checks for your dependencies" -ForegroundColor White
Write-Host "5. Monitor for unusual network activity from your Node.js applications" -ForegroundColor White