threat-intel
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
High
Summary
Threat actors compromised the Injective Labs GitHub repository and injected a malicious npm package designed to steal cryptocurrency wallet private keys and mnemonic seed phrases. The package, disguised as telemetry functionality, was spread across 17 dependent packages, putting a wide range of users at risk. Users are advised to update immediately and treat any received keys as compromised.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data