Hackers Embed Backdoor in Injective npm Package to Steal Wallet Keys

Security firm Socket has discovered that the npm package @injectivelabs/sdk-ts for the Injective blockchain has been maliciously altered. Attackers infiltrated the developer's GitHub account to implant malicious code designed to steal wallet private keys and recovery phrases. The stolen data is encoded and sent to an address disguised as a legitimate Injective network server. The package has approximately 50,000 downloads per week, and the malicious version 1.20.21 began showing suspicious commits on June 8, being locked within 17 other packages in the Injective Labs npm scope, meaning users who did not directly install the SDK may also be affected. Injective CEO Eric Chen stated that the issue has been resolved, the affected versions have been deprecated, and there is no risk to funds on the network. However, the malicious package has been downloaded over 310 times, and security firm Socket claims that the attack has not been fully contained.

Disclaimer: This content is provided for general branding and informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online events, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets or to use any services. Crypto assets are highly volatile and may result in loss. WEEX services and online events may not be available in all regions and are subject to applicable laws, regulations, and eligibility requirements. You are responsible for ensuring that your use of WEEX services complies with local laws and for carefully assessing the risks before participating in any crypto-related activities.