> TritonInfoSec News
Home / Jul 12, 2026 / Story
0
#3 The Hacker News general July 10, 2026 at 17:29 UTC

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

By [email protected] (The Hacker News)

AI Summary

Attackers compromised the Injective Labs SDK GitHub repository and published malicious npm package @injectivelabs/[email protected], which embedded fake telemetry functionality to exfiltrate cryptocurrency wallet private keys and mnemonic seed phrases. The incident represents a classic software supply chain attack targeting the Web3/DeFi ecosystem, where a single compromised dependency can drain multiple users' wallets.

Read full article → https://thehackernews.com/2026/07/injective-labs-g…

Relevance score: 79.0/100

# More from July 12

  1. 1
    Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News
  2. 2
    New U-Boot flaws could enable stealthy firmware attacks BleepingComputer
  3. 4
    Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions The Hacker News
  4. 5
    ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism SecurityWeek
  5. 6
    'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets BleepingComputer
  6. 7
    Former ransomware negotiator gets 4 years for BlackCat attacks BleepingComputer
  7. 8
    Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers The Hacker News
  8. 9
    Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched The Hacker News
  9. 10
    Network of 200 GitHub Repositories Used for Malware Infection SecurityWeek