Injective SDK on npm infected with cryptocurrency wallet stealer

A malicious release (v1.20.21) of the @injectivelabs/sdk-ts npm package — published after a GitHub contributor account was compromised — contained code that captured wallet mnemonics and private keys when SDK wallet-generation/import functions were called, encoded them in base64, and exfiltrated them via HTTP POST to an Injective Labs infrastructure endpoint; the malicious package was downloaded at least 310 times and 17 related packages were pinned to the compromised version, potentially affecting a broad set of developers and dependent projects.