In general, to fix log injection, any user-controlled value that is written to logs should be sanitized to remove characters that can break the log format (such as \r and \n) or otherwise be encoded/escaped. For plain-text logs, a simple and effective approach is to strip carriage-return and newline characters from the value before interpolation, while keeping the semantics the same for non-malicious inputs.

In this specific case, the only problematic usage is in modules/sdk-api/src/bitgoAPI.ts, where this._token?.substr(0, 8) ?? '(strategy-managed)' is interpolated into a debug() call. The best minimal fix is to compute a local safeTokenPrefix that is based on the same 8-character prefix but with any \r or \n characters removed, and then log that sanitized prefix instead of the raw substring. This does not change functional behavior (the token is not used for logic, only for display) but ensures that no unexpected newlines can be injected into the log. No new imports or external libraries are required; we can use String.prototype.replace with a simple regex.

Concretely, in requestPatch where debug('sending v2 %s request to %s with token %s', ...) is called, we will introduce a local const safeTokenPrefix = this._token ? this._token.substr(0, 8).replace(/[\r\n]/g, '') : '(strategy-managed)'; and then pass safeTokenPrefix as the third format argument to debug. This confines the change to the immediate logging context and preserves the existing logging format.