hackers tried to slip a backdoor into Injective's npm package to drain wallet keys. caught it in time but the supply chain attack playbook is getting bold lol