Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

Reported 10 Jul 2026 by otx · Severity: medium

A compromised version of the Injective Labs TypeScript SDK npm package was published containing malicious code that exfiltrates cryptocurrency wallet private keys and mnemonic phrases. The malicious version 1.20.21 was published on June 8, 2026, through a compromised developer ac