Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Unknown actors compromised Injective Labs' GitHub and published a malicious npm package (@injectivelabs/[email protected]) that implanted fake telemetry to capture and exfiltrate cryptocurrency mnemonics and private keys; the poisoned release was also published across 17 additional @injectivelabs scoped packages via a trusted maintainer/pipeline, and users are advised to update to 1.20.23, treat keys as compromised, rotate them, and inspect transitive dependencies.