👾 @SocketSecurity has detected a malicious release of the @injective SDK on npm. Package version 1.20.21 contained fake telemetry functionality that silently exfiltrated wallet private keys and mnemonic phrases via POST requests to a char-obfuscated endpoint masquerading as legitimate Injective network infrastructure. According to Socket, the compromised version was downloaded 310 times and the same malicious release was found across 17 additional Injective Labs scoped packages pinned to the affected version. Researchers recommend treating any private key or mnemonic phrase passed through these packages as compromised and rotating them immediately.

Ok, the new @injective site is actually really nice, not gonna lie. Clean UI, colours feel warm rather than the usual cold crypto-site vibe, and it's laid out in a very simple way. Devs can build financial apps, enterprises can bring assets on-chain, and normal users like me can check stats and poke around without getting lost. $INJ ate with this redesign

Software supply chain attacks are all the rage these days, with attackers more commonly targeting trusted developer tools rather than end users. The case of #Injective is a good example.

Hackers compromised the GitHub account of a developer from the Injective project and released a malicious npm package designed to steal private keys and seed phrases directly from wallet creation functions. 🔑 This package received approximately 50,000 downloads per week, and the malicious version was linked to 17 other packages. ⏱️ The malicious code remained on the system for less than one hour but was already downloaded over 300 times. 🕵️ The most insidious aspect: stolen keys were exfiltrated through a domain impersonating Injective’s official server, making the traffic appear legitimate to detection systems. 💸 CertiK reported that wallet compromise was the most profitable attack vector in the first half of 2026, resulting in $444 million in losses across just 33 incidents—an average of over $13 million per attack. The blockchain itself was not hacked; the keys were stolen the moment they were generated. In this scenario, is crypto security in 2026 vulnerable because of on-chain code—or the humans who wrote it?