Attackers compromised the Injective Labs SDK GitHub repository and used it to publish a malicious version of the SDK on the npm registry. This malicious package contained code that exfiltrated cryptocurrency wallet private keys and mnemonic seed phrases from users who installed it. The compromise affects the npm package distribution channel for the Injective SDK. No specific affected versions or patch information are provided in the available data. The incident was reported by Bleeping Computer.

The primary impact is the theft of sensitive cryptocurrency wallet credentials, including private keys and mnemonic seed phrases, which can lead to unauthorized access and theft of cryptocurrency assets from affected users. There is no indication of exploitation in the wild beyond the initial compromise report.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify the integrity of the Injective SDK package before installation and avoid using versions published during the compromise period until an official fix or advisory is released. Monitoring official Injective Labs communications for updates is recommended.