Attackers hijacked a trusted Injective Labs software package on npm by accessing a contributor's GitHub account and injecting malware. The compromised SDK stole private keys and seed phrases from developers' wallets, affecting over 50,000 weekly downloads and spreading through 17 dependent packages. Although a clean version was released, the malicious package remains accessible, urging users to rotate credentials and move funds to new wallets. This incident highlights growing risks in software supply chains and coincides with a separate $20 million crypto hack at BonkDAO.
A compromised update to the Injective developer npm package was downloaded over 300 times, exposing private keys and seed phrases through fake telemetry. The malicious code intercepted wallet key-generation functions and sent sensitive data to a fake...
Injective's Community BuyBack program achieved a record by burning nearly 43,500 INJ tokens on July 8, removing about $200,000 worth of tokens from circulation. This marks the highest community participation since the program's late 2025 launch, whic...
