Feb 28, 2026

New

• Medium✕Still activeAI · Agent target

  Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent

  ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines.

  AI trading agent projects and Web3 developers on npm·Solana·Since Feb 28, 2026·updated 6 months ago