Compromised @injectivelabs (Injective SDK) npm packages via maintainer account takeover. A single malicious version 1.20.21 was published across 18 lockstep-versioned scoped packages on 2026-06-08. @injectivelabs/sdk-ts@1.20.21 carries the payload: it hooks the wallet key-derivation functions fromMnemonic and fromHex to intercept private keys and mnemonic phrases, base64-encodes them, and exfiltrates via HTTP POST to an attacker endpoint disguised as Injective infrastructure.