{
 "tag": "ai-generated-code",
 "name": "Ai Generated Code",
 "group": "Other",
 "incidents": [
  {
   "slug": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "title": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "json": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Check Point Research describes the payload as an AI-generated PowerShell backdoor."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Blockchain and crypto developers and engineering teams (Asia-Pacific)",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "konni",
    "powershell",
    "backdoor",
    "ai-generated-code",
    "blockchain-developers",
    "phishing",
    "check-point",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-01-22",
   "closedAt": "2026-01-22",
   "updatedAt": "2026-01-22T12:00:00Z",
   "summary": "Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported."
  },
  {
   "slug": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "title": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "json": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Safety's researchers say the code appears largely AI-generated, citing emojis, heavy comments and logging they link to Anthropic's Claude; this is an inference from code style."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "npm package @kodane/patch-manager",
   "tags": [
    "solana",
    "supply-chain",
    "npm",
    "kodane",
    "ai-generated-code",
    "claude",
    "wallet-drainer",
    "postinstall",
    "safety",
    "railway",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-07-28",
   "closedAt": "2025-07-30",
   "updatedAt": "2025-08-01T12:00:00Z",
   "summary": "On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published."
  }
 ],
 "changes": [
  {
   "incident": "konni-ai-generated-backdoor-blockchain-developers-jan-2026",
   "incidentTitle": "North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-22",
   "title": "Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.",
   "sourceUrl": "https://blog.checkpoint.com/research/ai-powered-north-korean-konni-malware-targets-developers/",
   "url": "https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-01",
   "title": "The Register reported more than 1,500 downloads and the signs of AI-written code.",
   "sourceUrl": "https://www.theregister.com/2025/08/01/emoji_use_ai_malware/",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-31",
   "title": "Safety published its analysis, including the attacker's Solana address and an open command server.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-30",
   "title": "npm marked the package as malicious.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-28",
   "title": "The package was first published to npm; 19 versions followed over two days.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  }
 ]
}