# Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor

DevFeed: [Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor](<https://devfeed.tech/articles/not-so-anonymous-telemetry-the-injectivelabs-sdk-ts-backdoor-8295.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/not-so-anonymous-telemetry-injectivelabs-sdk-ts-backdoor/>)

Author: Sebastian Obregoso, Christophe Tafani-Dereeper, Eslam Salem

Published: 2026-07-09T00:00:00Z

Content type: news

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [backdoor](<https://devfeed.tech/topics/backdoor.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [Blockchain](<https://devfeed.tech/topics/blockchain.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Git](<https://devfeed.tech/topics/git.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Bitcoin](<https://devfeed.tech/topics/bitcoin.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>), [servers](<https://devfeed.tech/topics/servers.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Prettier](<https://devfeed.tech/topics/prettier.md>)

Tags: [backdoor](<https://devfeed.tech/tags/backdoor.md>), [bitcoin](<https://devfeed.tech/tags/bitcoin.md>), [blockchain](<https://devfeed.tech/tags/blockchain.md>), [ci](<https://devfeed.tech/tags/ci.md>), [code](<https://devfeed.tech/tags/code.md>), [git](<https://devfeed.tech/tags/git.md>), [github](<https://devfeed.tech/tags/github.md>), [http](<https://devfeed.tech/tags/http.md>), [malware](<https://devfeed.tech/tags/malware.md>), [server](<https://devfeed.tech/tags/server.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

## AI overview

A malicious commit briefly compromised the Injective blockchain's @injectivelabs/sdk-ts npm package by disguising a credential-stealing backdoor as telemetry code. The malware captured wallet mnemonic seed phrases and private keys, encoded them, and exfiltrated them through HTTP requests to a remote endpoint before the code was reverted.

## Source excerpt

A malicious commit disguised as SDK telemetry briefly compromised @injectivelabs/sdk-ts, exfiltrating wallet mnemonics and private keys.