Malicious Injective SDK npm package exfiltrated crypto wallets via fake telemetry
A compromised GitHub account let attackers publish version 1.20.21 of @injectivelabs/sdk‑ts, which silently captured wallet private keys and mnemonic seeds when SDK functions ran. The code exfiltrated the data to an Injective Labs endpoint, affecting developers who updated the package before the fix. Rotate wallets and purge the infected version immediately.