A malicious release of @injectivelabs/sdk-ts hid a wallet-key stealer inside code labeled as usage telemetry, then spread it across 17 more npm packages. Here’s how it worked and how to check your projects. Category: Vulnerabilities & Threats
Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry
calendar_today
July 9, 2026
domain
aikido-security