# AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads

- Severity: High · Status: Contained (past)
- Chains: Solana · Method: Supply-chain stealers
- Started: Jul 28, 2025 · Last update: Aug 1, 2025
- Who/what: npm package @kodane/patch-manager
- AI involvement: AI-built malware. Safety's researchers say the code appears largely AI-generated, citing emojis, heavy comments and logging they link to Anthropic's Claude; this is an inference from code style.

On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published.

## Am I affected?
If @kodane/patch-manager (any version) was installed on a machine or in a project between 28 and 30 July 2025, assume any wallet on that machine was found and drained.

## What to do now
- Remove the package, then from a clean device move what is left to new wallets with new seed phrases.
- Reinstall the system if you cannot be sure the installer's leftover files are gone.

## How to avoid this
- Read install scripts (postinstall) before adding unknown packages, and prefer well-known, long-lived ones.
- Never keep hot wallets on a development machine.
- Use a package scanner that flags new or suspicious packages before install.

## Indicators (block these, never visit them)
- Domain: sweeper-monitor-production.up.railway[.]app
- Domain: sweeper-monitor.railway[.]app
- Address: B2XwbrGSXs3LAAcqFqKqGUug5TFA1Bug2NNGH3F3mWNK

## Sources
- Threat actor uses AI to create a better crypto wallet drainer (Safety, 2025-07-31): https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer
- Rampant emoji use suggests crypto-stealing NPM package was written by AI (The Register, 2025-08-01): https://www.theregister.com/2025/08/01/emoji_use_ai_malware/

Full record: https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025 · JSON: https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.