Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

A compromised version of the @injectivelabs/sdk-ts npm package (1.20.21) was published with malicious code designed to exfiltrate cryptocurrency wallet private keys and mnemonic phrases. The backdoor was introduced via a compromised developer account and spread to 17 additional scoped packages that pinned the malicious version. The stolen data was exfiltrated via POST requests to a seemingly legitimate Injective Labs infrastructure endpoint, enabling attackers to reconstruct and access victims' wallets. Although the incident was quickly detected and mitigated, the malicious package versions remain downloadable.

AI-extracted · verify before operational use