Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository, using it to publish a malicious package on the npm registry. This package, version @injectivelabs/sdk-ts@1.20.21, was designed to steal cryptocurrency wallet private keys and mnemonic seed phrases. The malicious version included fake telemetry functionality that allowed it to exfiltrate data from cryptocurrency wallets. The compromise was used to push this malicious package, which targeted cryptocurrency users. The malicious package was embedded with data-stealing capabilities.