CoinWorld News — According to Cointelegraph, security firm Socket discovered that the Injective blockchain’s npm package /sdk-ts was maliciously modified. The attacker infiltrated the developer’s GitHub account, implanted malicious code to steal wallet private keys and seed phrases, and sent the data to an address disguised as a legitimate Injective network server. The package has approximately 50,000 weekly downloads. The malicious version 1.20.21 began having suspicious commits on June 8 and was locked within 17 other packages in the Injective Labs npm scope.

INJ0.04%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • 4
  • 1
  • Share
Comment
Add a comment
Add a comment
AirdropCheatSheet
· 9h ago
50k weekly downloads... How many private keys have already been leaked?
View OriginalReply0
GateUser-818d3026
· 9h ago
GitHub account security is now as important as wallet security.
View OriginalReply0
Post-RainCancellationAgent
· 9h ago
NPM scope locked 17 packages, which spreads the attack surface widely enough.
View OriginalReply0
GateUser-dd8dffab
· 9h ago
Supply chain attacks are truly hard to guard against—once a developer account is lost, the entire network suffers.
View OriginalReply0
  • Pinned