👾 @SocketSecurity has detected a malicious release of the @injective SDK on npm. Package version 1.20.21 contained fake telemetry functionality that silently exfiltrated wallet private keys and mnemonic phrases via POST requests to a char-obfuscated endpoint masquerading as legitimate Injective network infrastructure. According to Socket, the compromised version was downloaded 310 times and the same malicious release was found across 17 additional Injective Labs scoped packages pinned to the affected version. Researchers recommend treating any private key or mnemonic phrase passed through these packages as compromised and rotating them immediately.