Security Firm: Hackers Attempt to Implant Backdoor in Injective npm Package to Steal Wallet Keys

CoinFeed July 10 news, according to Cointelegraph, security firm Socket discovered that the Injective blockchain's npm package @injectivelabs/sdk-ts was maliciously modified. Attackers implanted malicious code to steal wallet private keys and mnemonic phrases by compromising a developer's GitHub account, and sent the stolen data encoded to an address disguised as a legitimate Injective network server. The package has about 50,000 weekly downloads. The malicious version 1.20.21 had suspicious commits starting June 8, and was locked in 17 other packages within Injective Labs' npm scope, meaning even users who did not directly install the SDK could be affected.