Compromised Injective Labs SDK distributes wallet-key stealing code

Attackers compromised a legitimate contributor account associated with the Injective Labs SDK repository and inserted malicious code into the official @injectivelabs/sdk-ts package. Version 1.20.21 was published on June 8, 2026 with code that intercepted wallet key-derivation operations and exfiltrated mnemonic phrases and private keys through disguised telemetry. Seventeen additional Injective-scoped packages were published with dependencies pinned to the compromised SDK, extending the software supply-chain exposure to downstream developers and applications. The malicious release was detected and reverted quickly, with approximately 310 downloads reported during the exposure window.