Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent
AI trading agent projects and Web3 developers on npm
ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines.
Why this severity: Still active, a narrower target.
AI involvement
AI agents as the target. The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents.
Give agents a small, capped wallet with allow-listed destinations, and never let an agent that can sign read untrusted content.
- Started
- Feb 28, 2026
- Closed
- Apr 29, 2026
- Chains
- Solana
- Method
- Supply-chain stealers
At risk
- AI trading agent projects and Web3 developers on npm
- Solana wallets
What to do now
- Remove those packages, then rotate every key and secret in .env and JSON files on affected machines.
- Move funds from any wallet the agent or machine could reach, and remove unknown entries from SSH authorized_keys.
Stay safe
Am I affected?
Check your lockfiles if you build Solana or Web3 tools or AI trading agents. Named packages include @validate-sdk/v2, @hash-validator/v2, @solana-launchpad/sdk, @meme-sdk/trade, @validate-ethereum-address/core, @solmasterv3/solana-metadata-sdk, @pumpfun-ipfs/sdk, @solana-ipfs/sdk and the PyPI package scraper-npm.
What to do now
- Remove those packages, then rotate every key and secret in .env and JSON files on affected machines.
- Move funds from any wallet the agent or machine could reach, and remove unknown entries from SSH authorized_keys.
How to avoid this
- Review every new dependency an AI coding assistant adds before merging, especially in projects that hold wallet keys.
- Give trading agents a small, capped wallet and keep main funds where the agent cannot reach them.
- Lock dependencies and run a package scanner in CI.
Timeline 2
News & write-ups ›1
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.