Skip to content
~/drains.watch_
Soon
← Tags·Other

Ai Generated Code

2 incidents, 0 live. 273 days since the last new one.

1 drains in the last 12 months

1 drains in the last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct
MonWedFri
Critical 4 · High 3 · Med 2 · Low 1 · Update ½ Less More

Follow this tag

Past

January 2026 1

  • Medium✕Still activeAI · AI malware

    North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor

    Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported.

    Blockchain and crypto developers and engineering teams (Asia-Pacific)·Multiple EVM chains·Since Jan 22, 2026·

July 2025 1

  • High✓ContainedAI · AI malware

    AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads

    On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published.

    npm package @kodane/patch-manager·Solana·Since Jul 28, 2025·

Brief for your AI


Get notified about new drains

Follow every new drain and update in your feed reader, Slack, Discord or Telegram RSS bot:

Only follow a chain or a method you care about: every tag has its own feed at /t/<tag>/feed.xml.

Copied