Malware in @injectivelabs/sdk-ts
What to do
- Check every lockfile and build cache for the affected versions below and remove them.
- Rotate any secrets (tokens, keys, cloud credentials) that were available to machines that installed them.
- Pin to a known-good version and reinstall from a clean lockfile.
Malicious versions
@injectivelabs/sdk-ts
- = 1.20.21
Check your project: npm ls @injectivelabs/sdk-ts --all
What changed
Published in the GitHub Advisory Database as critical.