{
 "slug": "promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
 "title": "Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent",
 "url": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026",
 "json": "https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "active",
 "verification": "verified",
 "ai": {
  "role": "agent-target",
  "note": "The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents."
 },
 "chains": [
  "solana"
 ],
 "method": "supply-chain",
 "product": "AI trading agent projects and Web3 developers on npm",
 "tags": [
  "solana",
  "supply-chain",
  "npm",
  "pypi",
  "ai-coding-agent",
  "claude",
  "ai-trading-bot",
  "famous-chollima",
  "north-korea",
  "dprk",
  "promptmink",
  "ai"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-02-28",
 "closedAt": "2026-04-29",
 "updatedAt": "2026-04-29T12:00:00Z",
 "summary": "ReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines.",
 "timeline": [
  {
   "date": "2026-02-28",
   "title": "A commit co-authored by Claude Opus added @solana-launchpad/sdk to the openpaw-graveyard trading agent, pulling in the malicious @validate-sdk/v2.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto"
  },
  {
   "date": "2026-04-29",
   "title": "ReversingLabs published its findings and linked the campaign to Famous Chollima.",
   "sourceUrl": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "Claude adds malware to crypto agent",
   "url": "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
   "publisher": "ReversingLabs",
   "date": "2026-04-29"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nCheck your lockfiles if you build Solana or Web3 tools or AI trading agents. Named packages include @validate-sdk/v2, @hash-validator/v2, @solana-launchpad/sdk, @meme-sdk/trade, @validate-ethereum-address/core, @solmasterv3/solana-metadata-sdk, @pumpfun-ipfs/sdk, @solana-ipfs/sdk and the PyPI package scraper-npm.\n\n## What to do now\n- Remove those packages, then rotate every key and secret in .env and JSON files on affected machines.\n- Move funds from any wallet the agent or machine could reach, and remove unknown entries from SSH authorized_keys.\n\n## How to avoid this\n- Review every new dependency an AI coding assistant adds before merging, especially in projects that hold wallet keys.\n- Give trading agents a small, capped wallet and keep main funds where the agent cannot reach them.\n- Lock dependencies and run a package scanner in CI.",
 "notes": null,
 "agentBrief": "# Claude-assisted commit adds a North Korea-linked wallet-stealing npm package to an AI crypto trading agent\n\n- Severity: Medium · Status: Still active (past)\n- Chains: Solana · Method: Supply-chain stealers\n- Started: Feb 28, 2026 · Last update: Apr 29, 2026\n- Who/what: AI trading agent projects and Web3 developers on npm\n- AI involvement: AI agents as the target. The malicious dependency entered an AI trading agent through a commit co-authored by Claude Opus, and ReversingLabs assesses the attackers wrote promotional package pages to lure AI coding agents.\n\nReversingLabs reported on 29 April 2026 that a 28 February commit to openpaw-graveyard, an autonomous crypto trading agent built for Solana, was co-authored by Claude Opus and added a bait package (@solana-launchpad/sdk) that silently pulled in the malicious @validate-sdk/v2. The payload steals .env and JSON files and crypto wallet credentials, and adds attacker SSH keys for remote access. ReversingLabs ties the campaign, 60+ packages and 300+ versions over about seven months, to North Korea's Famous Chollima and believes it deliberately targets AI coding agents. No losses were reported; check lockfiles for the named packages and rotate keys on affected machines.\n\n## Am I affected?\nCheck your lockfiles if you build Solana or Web3 tools or AI trading agents. Named packages include @validate-sdk/v2, @hash-validator/v2, @solana-launchpad/sdk, @meme-sdk/trade, @validate-ethereum-address/core, @solmasterv3/solana-metadata-sdk, @pumpfun-ipfs/sdk, @solana-ipfs/sdk and the PyPI package scraper-npm.\n\n## What to do now\n- Remove those packages, then rotate every key and secret in .env and JSON files on affected machines.\n- Move funds from any wallet the agent or machine could reach, and remove unknown entries from SSH authorized_keys.\n\n## How to avoid this\n- Review every new dependency an AI coding assistant adds before merging, especially in projects that hold wallet keys.\n- Give trading agents a small, capped wallet and keep main funds where the agent cannot reach them.\n- Lock dependencies and run a package scanner in CI.\n\n## Sources\n- Claude adds malware to crypto agent (ReversingLabs, 2026-04-29): https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto\n\nFull record: https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026 · JSON: https://drains.watch/i/promptmink-ai-assisted-commit-malicious-npm-trading-agent-apr-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}