GitHub OIDC Pipeline Abuse Pushes 18 Malicious @injectivelabs Packages Stealing Wallet Mnemonics

The attack inserted fake usage metrics into key derivation workflows across the @injectivelabs scoped namespace. Malicious code queued multiple mnemonic captures over two seconds before POSTing them to testnet.archival.chain.grpc-web.injective.network, avoiding install-time scripts to evade detection. Seventeen dependent packages including wallet-core, wallet-evm, and wallet-ledger inherited the compromise through version pinning.

Socket, StepSecurity, and OX Security independently confirmed the commits originated from the repository's own OIDC workflow under an established contributor account. Release artifacts remain downloadable from GitHub despite npm deprecation of version 1.20.21. The payload activates only on actual key-generation calls, capturing hex or mnemonic data plus derivation method markers.

This incident fits an accelerating pattern of OIDC and maintainer-account abuse against crypto-adjacent open-source projects. Trusted-publisher pipelines remove multi-factor checks once configured, turning GitHub into a single point of failure. Earlier supply-chain compromises demonstrated similar reuse of developer identities; the difference here is explicit targeting of wallet primitives rather than generic credential theft.

Projects using any @injectivelabs package since July 8 must rotate affected keys immediately. Registries and GitHub will face pressure to add runtime attestation and commit-signing enforcement; without those controls, further OIDC-mediated injections targeting financial libraries are probable within the next quarter.