Pinned transitive packages widened this from one bad release into a broader wallet theft risk. Teams that only check top-level installs can miss the malicious code, because the poisoned version was copied into 17 scoped packages tied to the same release.
The malicious @injectivelabs/sdk-ts 1.20.21 release was published to npm with fake telemetry that actually read and exfiltrated wallet private keys and mnemonic phrases. Socket says the package gets about 50,000 weekly downloads, and the same version was pushed across 17 @injectivelabs scoped packages, extending exposure to transitive users who never installed the SDK directly.
The practical break is trust in pinned npm dependencies: the version number that should narrow exposure became the path that spread it. Even after the clean release, the malicious artifacts and deprecated package status left enough residue that teams need to treat affected wallet secrets as exposed.