GitHub Compromise at Injective Labs Enabled npm Package Tampering and Wallet Key Theft Risk

Colleagues, I would like to draw your attention to a cybersecurity incident: the Injective Labs SDK GitHub repository was compromised, and a malicious package was published via npm.

In brief:
• @injectivelabs/sdk-ts@1.20.21 may have stolen private keys and mnemonic seed phrases.
• The code was disguised as telemetry and triggered when library functions were used.
• Transitive dependencies of other @injectivelabs packages were also exposed.

Recommendation: upgrade to the clean 1.20.23 release, review dependencies, and treat any keys that passed through the package as compromised.

Why it matters: supply chain attacks can hit even trusted repositories.

How do you assess risk across your dependency chain? #cybersecurity #supplychain #npm #GitHub