Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry

A malicious npm release, @injectivelabs/[email protected], included an injected infostealer that hooks PrivateKey.fromMnemonic and fromHex to capture wallet seed phrases and raw private keys, batching and exfiltrating them in the X-Request-Id header to a spoofed Injective subdomain (testnet.archival.chain.grpc-web.injective.network). The poisoned SDK was republished across 17 other @injectivelabs packages via hard dependency pins to enable transitive compromise; the malicious version was live for under an hour, downloaded 310 times, and has been deprecated but remains downloadable—affected keys should be rotated and funds moved, and users should upgrade to the clean 1.20.23.