OTX Threat: Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics

A compromised version of the Injective Labs TypeScript SDK npm package was published containing malicious code that exfiltrates cryptocurrency wallet private keys and mnemonic phrases. The malicious version 1.20.21 was published on June 8, 2026, through a compromised developer account with established repository access. The malware hooks key generation functions to capture sensitive wallet data an Sectors: Technology