Malicious Injective SDK Version Found on npm Steals Wallet Keys
Socket discovered a malicious version (1.20.21) of the Injective SDK on npm that steals seed phrases and private keys. At least 300 downloads were recorded.
INJUSD
Security firm Socket has identified a malicious version of the Injective SDK in the npm registry. Package version 1.20.21 was designed to intercept wallet seed phrases and private keys, then exfiltrate them via a fake telemetry endpoint disguised as an Injective server.
According to Socket, the malicious package was downloaded at least 300 times. The same rogue release was also found in 17 other Injective Labs packages. Researchers recommend treating any keys or seed phrases that passed through the affected packages as compromised.
Source: ForkLog