Injective SDK on npm infected with cryptocurrency wallet stealer

Injective SDK on npm infected with cryptocurrency wallet stealer

Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet private keys and mnemonic seed phrases. [...]

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/sdk-ts@1.20.21, came embedded with fake telemetry functionality that exfiltrated data from cryptocurrency wallets. The version was

Injective npm Package Hit by Backdoor Attack Targeting Crypto Wallet Keys

Security researchers caught hackers trying to plant a backdoor inside the Injective npm package — a widely used tool in… Read the original on Injective npm Package Hit by Backdoor Attack Targeting Crypto Wallet Keys. For more crypto news and analysis, visit TheCurrencyAnalytics.com.

Injective npm Package Backdoor Targeted Wallet Keys Before Clean Release

Hackers pushed a malicious version of Injective’s TypeScript SDK to npm in a supply-chain attack designed to steal wallet recovery phrases and private keys from developer environments. The compromised release, @injectivelabs/sdk-ts@1.20.21, added code that captured mnemonics and raw private keys when applications created or loaded wallets. The payload was disguised as a telemetry helper and sent stolen secrets to an attacker-controlled endpoint …

npm 上的 Injective SDK 被植入加密货币钱包窃取器

npm 上的 Injective SDK 被植入加密货币钱包窃取器