Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets
· Source: infosecurity-magazine.com
In short
Researchers at ReversingLabs discovered a malicious npm dependency disguised as a validation tool, linked to an AI-assisted code commit co-authored by Anthropic's Claude Opus model. The campaign, tracked as PromptMink and attributed to North Korean state-sponsored actor Famous Chollima, exfiltrated sensitive data and exposed crypto wallets. The malware evolved over seven months across more than 60 packages, expanding from credential theft to persistent remote access across Linux and Windows environments.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 18, 2026: Agentic AI and Physical Automation Drive Supply Chain Breakthroughs
Tags: supply chain, security, malware, npm, crypto, AI