{
 "tag": "wallet-drainer",
 "name": "Wallet Drainer",
 "group": "Drainer kits & crews",
 "incidents": [
  {
   "slug": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "title": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "json": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Safety's researchers say the code appears largely AI-generated, citing emojis, heavy comments and logging they link to Anthropic's Claude; this is an inference from code style."
   },
   "chains": [
    "solana"
   ],
   "method": "supply-chain",
   "product": "npm package @kodane/patch-manager",
   "tags": [
    "solana",
    "supply-chain",
    "npm",
    "kodane",
    "ai-generated-code",
    "claude",
    "wallet-drainer",
    "postinstall",
    "safety",
    "railway",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-07-28",
   "closedAt": "2025-07-30",
   "updatedAt": "2025-08-01T12:00:00Z",
   "summary": "On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published."
  }
 ],
 "changes": [
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-01",
   "title": "The Register reported more than 1,500 downloads and the signs of AI-written code.",
   "sourceUrl": "https://www.theregister.com/2025/08/01/emoji_use_ai_malware/",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-31",
   "title": "Safety published its analysis, including the attacker's Solana address and an open command server.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-30",
   "title": "npm marked the package as malicious.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  },
  {
   "incident": "kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025",
   "incidentTitle": "AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-07-28",
   "title": "The package was first published to npm; 19 versions followed over two days.",
   "sourceUrl": "https://www.getsafety.com/blog-posts/threat-actor-uses-ai-to-create-a-better-crypto-wallet-drainer",
   "url": "https://drains.watch/i/kodane-patch-manager-ai-generated-solana-drainer-npm-jul-2025"
  }
 ]
}