Malicious npm Dependency Injected via AI-Assisted Commit Targeting Crypto Trading
A North Korean state-sponsored group reportedly injected malicious code into a cryptocurrency trading project via a code commit co-authored by Anthropic's Claude Opus, enabling credential theft and unauthorized access to crypto wallets. Researchers attributed the campaign to Famous Chollima and found evidence the attackers deliberately shaped malicious packages to exploit AI coding assistants.
What happened
On February 28, 2026, a code commit co-authored by Anthropic's Claude Opus was submitted to the npm package openpaw-graveyard, an autonomous crypto trading agent. The commit added @solana-launchpad/sdk as a dependency, which silently pulled in a second malicious package named @validate-sdk/v2, disguised as a data validation tool.
According to ReversingLabs, the campaign, tracked as PromptMink, employed a two-layer package strategy where legitimate-appearing tools attracted adoption while secondary dependencies delivered the malware. The researchers tracked more than 60 packages and over 300 versions across a seven-month period, indicating sustained activity and refinement of delivery techniques.
Attribution points to North Korean state-sponsored actor Famous Chollima (also known as APT37 or Reaper), which has been active since 2018 and is known for targeting cryptocurrency developers. ReversingLabs noted that code evidence, including leftover prompts, suggests large language models were used in the malware's development.
Reported impact
The malicious package enabled attackers to exfiltrate secrets from infected environments and access crypto wallet funds. The malware's capabilities included scanning directories for environment files and crypto-related data, collecting system information such as usernames and IP addresses, compressing project folders before exfiltration, and installing SSH keys to enable persistent remote access.
As the campaign progressed, the underlying payload evolved from JavaScript-based code to compiled binaries and Rust-based payloads, improving evasion and enabling operation across Linux and Windows environments.
Index analysis
ReversingLabs researchers first uncovered the scheme after tracking suspicious versions of @validate-sdk/v2 since October 2025. The researchers attributed PromptMink to Famous Chollima, the same actor previously connected to the Contagious Interview campaign targeting software developers.
Governance controls
ReversingLabs noted that attackers are increasingly shaping malicious packages to appeal to AI coding assistants, extending supply chain risk into automated development workflows.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.