Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

2026-07-13

A malicious Injective TypeScript SDK release (@injectivelabs/sdk-ts@1.20.21) logs mnemonics and private key material, then sends them via a POST request to an InjectiveLabs infrastructure endpoint, allowing attackers to rebuild wallet keys. The same version was pushed to 17 related packages, so developers must audit dependencies, move funds from affected wallets, and rotate keys and mnemonics.