Socket found that a compromised Injective npm package copied private keys and seed phrases through fake telemetry.The malicious version was downloaded more than 300 times and spread through 17 related Injective Labs packages.CertiK reported that wallet compromises caused $444 million in losses during the first half of 2026.