Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys (Campaign)

A compromised maintainer account led to a malicious release of @injectivelabs/[email protected] that intercepted wallet mnemonics and private keys by altering `fromMnemonic` and `fromHex` functions; captured secrets were Base64-encoded and sent via HTTPS POST to an Injective-owned endpoint. The malicious SDK was published across 17 additional packages (directly or transitively depending on it), received ~310 downloads before deprecation, and could affect downstream projects that relied on the compromised version.