Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

A malicious release of @injectivelabs/sdk-ts, an npm package that pulls around 50,000 weekly downloads, shipped code that records wallet mnemonics and private keys as they are derived and ships them to an attacker-controlled endpoint. The bad version, 1.20.21, was live on npm for under an hour on June 8, 2026 before the maintainer noticed and published a clean fix. In that window the attacker also republished the same 1.20.21 version number across 17 other packages in the @injectivelabs scope, each pinned to the poisoned SDK, so that projects depending on any of them would pull the stealer in transitively.

A compromised SDK update exfiltrated wallet keys through fake telemetry, combining a software-supply-chain compromise with direct cryptocurrency-theft risk.