Security firm Socket discovers malicious code injected into the Injective blockchain npm package

According to Cointelegraph, security firm Socket discovered that the Injective blockchain’s npm package @injectivelabs/sdk-ts had been maliciously modified. Attackers infiltrated a developer’s GitHub account and implanted malicious code designed to steal wallet private keys and mnemonic phrases, sending the data to an address disguised as a legitimate Injective network server. This package is downloaded around 50,000 times per week. The malicious version 1.20.21 started showing suspicious commits on June 8 and was also locked in 17 other packages within the Injective Labs npm scope.