North Korea's PromptMink and Mastra campaigns show how AI coding agents became the new front in crypto supply chain attacks, stealing wallets through poisoned npm dependencies.
Crypto Supply Chain Attacks Now Ride In Through AI Coders
On February 28, 2026, a routine code commit landed in an open-source Solana trading bot called openpaw-graveyard. It added a single dependency, @solana-launchpad/sdk. The commit was co-authored by Anthropic's Claude Opus. The dependency looked clean — polished README, correct TypeScript types, real Solana functionality. It also silently pulled in @validate-sdk/v2, a North Korean credential stealer that handed its operators a path to the project's wallets and funds. The crypto supply chain attack has entered its AI era, and almost nobody is defending the right layer.
ReversingLabs, the threat-intelligence firm that uncovered the campaign and named it PromptMink, put the twist in one line: the malicious packages were "more successful in tricking LLM coding agents than humans to use them." That sentence should terrify anyone building in crypto right now.
Here is the argument I want to make, and it is deliberately uncomfortable: crypto has spent a decade and hundreds of millions of dollars auditing the blockchain — smart contracts, consensus logic, multisigs — while the actual money is now being stolen one layer up, at the developer's keyboard, by malware that the developer's own AI assistant hand-delivered. We have been defending the vault while the robbers learned to pick the lock on the room the vault sits in.
Key Takeaways
- ReversingLabs disclosed PromptMink on April 29, 2026: the North Korean group Famous Chollima used an AI coding assistant to plant a wallet-stealing npm dependency in a live autonomous trading agent.
- It is not isolated — the June 2026 Mastra attack (Sapphire Sleet) poisoned 140+ AI-framework packages in 88 minutes, and the first half of 2026 produced 497 malicious packages, roughly 4.5x the package volume of all of 2025.
- The money no longer moves through smart-contract exploits; it is stolen at the developer's workstation, through the software supply chain.
- The industry's race toward autonomous AI agents that hold private keys is building the exact target North Korea already knows how to drain.
Why Did the Attack Move Off-Chain?
PromptMink is a masterclass in targeting the human-and-machine gap. Famous Chollima (also tracked as Shifty Corsair, and overlapping with the BlueNoroff and Sapphire Sleet clusters) built a two-layer package architecture. The first layer is the bait — packages like @solana-launchpad/sdk, @meme-sdk/trade, and @validate-ethereum-address/core that ship genuine, useful Web3 functionality and no malicious code at all. The second layer is the disposable payload — @validate-sdk/v2 and its siblings — which do the actual stealing and can be swapped out within hours whenever a registry takes one down.
The part that should make the industry's blood run cold is how the bait was tuned. ReversingLabs calls the technique "LLM Optimization (LLMO) abuse": the packages were engineered with long, well-formatted READMEs and polished documentation so they read as the ideal answer to whatever task an AI coding agent has been handed. The code was itself "vibe-coded" — generated with an LLM — leaving stray artifacts like a comment asking "obfuscate the README?" sitting in production files. A human developer would have noticed a package with twelve downloads published last week. The agent saw only semantic fit and documentation quality.
Then the payloads escalated. Early versions were simple JavaScript infostealers that swept .env and .json files. Later variants grew into 80-megabyte Node.js single-executable binaries, then compiled Rust add-ons that planted attacker SSH keys for persistence and exfiltrated entire source trees. Across roughly seven months, the campaign published more than 60 unique packages spanning over 300 versions. Expel's independent research tied roughly $12 million in confirmed cryptocurrency theft to the operation in Q1 2026 alone.
Who Wins When AI Picks Your Dependencies?
This is not a single incident. It is a documented campaign. In April 2026, an attacker in the same orbit compromised the Axios HTTP client — one of the most-downloaded JavaScript libraries on earth — and through it the macOS app-signing workflow at OpenAI, forcing revocation of code-signing certificates for ChatGPT Desktop, Codex, and Atlas. In June 2026, Sapphire Sleet hijacked the dormant npm account "ehindero," a former Mastra contributor whose publishing rights had never been revoked, and republished more than 140 packages across the @mastra AI-agent framework in an 88-minute window. The poisoned payload, a typosquat of the ubiquitous dayjs library called easy-day-js, fired a postinstall dropper that targeted 166 cryptocurrency wallet browser extensions across Windows, macOS, and Linux.
Palo Alto's Unit 42 put a number on the trend: the first half of 2026 saw 37 campaigns and 497 malicious packages aimed at AI-agent tooling — roughly 2.6x the campaigns and 4.5x the package volume of all of 2025 combined. Socket has linked more than 1,700 malicious packages to this activity across npm, PyPI, Go, Rust, and Packagist since January 2025.
Who loses is obvious: every team "vibe coding" a production agent against unvetted dependencies, every solo developer whose laptop runs npm install on autopilot, and every protocol shipping an "autonomous agent" feature with hot-key access. Who wins is just as clear: the security vendors treating AI coding agents as an attack surface rather than a verification layer — ReversingLabs, Socket, Snyk, Sonatype — and the registries that get forced, finally, into provenance attestation, scoped publish expiry, and mandatory two-factor authentication.
Has This Happened Before?
Yes — but never at this speed or with this asymmetry. The event-stream backdoor in 2018 and the coa/rc and ua-parser-js compromises of 2021 proved the npm supply chain was soft. North Korea's Contagious Interview campaign spent years luring crypto developers through fake job interviews and trojanized coding assessments. What changed in 2026 is the removal of the human bottleneck. The attacker no longer has to trick a developer into installing the wrong thing; they trick the model's package-selection heuristic, and the developer merges the result as a "co-authored" commit that carries an AI provenance stamp many reviewers now reflexively trust.
It is SEO poisoning for code — the same playbook people use to game Google results, applied to dependency resolution. And it has a sibling the industry barely talks about: "slopsquatting," where an AI agent hallucinates a plausible package name during generation, and attackers register that exact name later so the next agent to "complete" the same task pulls the trap. The vulnerability is not in the model. It is in a pipeline that gives an agent authority to add dependencies and run install scripts with no pre-merge reputation or malware gate.
Where Is This Heading in One to Three Years?
The first wave of defense will be boring and mostly effective: per-package authorization, lockfile and provenance enforcement, sandboxed installs, treating postinstall hooks as untrusted by default, and threat-intel feeds plugged into the coding agent's context. The second wave is where it gets ugly. Attackers will follow the trust upstream — into model weights, fine-tuning data, and MCP servers, the connective tissue of the agent economy. Google's Threat Intelligence Group already documented the first AI-generated zero-day exploit used in the wild in 2026. North Korea is not going to stop; crypto theft is a state revenue line.
My prediction: within three years, "who wrote the code and what it pulls in" becomes the real security question, and "code is law" dies as a posture. Autonomous agents that touch funds will be treated as privileged users subject to least-privilege review, and a supply-chain attestation standard — the crypto equivalent of SOC 2 — becomes table stakes for anything that holds a key. The projects that survive are the ones that treat their dependency graph with the same paranoia they once reserved for their smart contracts.
What Does This Mean for Traders?
Not price — risk. The strategic takeaway is a re-prioritization of where your capital is actually exposed. If you run or rely on bots and agents that touch keys, ask the uncomfortable question: who or what added their dependencies, and can that agent introduce a new package without a human signing off? Scrutinize any protocol that ships an autonomous-agent feature with hot-key custody — the blast radius is new, large, and almost certainly mispriced.
The concrete moves cost nothing and compound: pin dependencies, commit lockfiles, enable package provenance, treat postinstall hooks as untrusted, review every AI-authored commit that touches package.json, and rotate .env files, SSH keys, and API tokens on any machine that ran npm install during a known compromise window. The alpha in this market for the next eighteen months is not a token. It is still having your keys at the end of them.
The most dangerous thing in crypto in 2026 is not a smart-contract bug — it is a developer trusting their AI to pick a "validation library." North Korea did not beat the blockchain; it beat the person sitting in front of it, borrowing their own productivity tool to do the dirty work. So here is the question I cannot shake: we obsess over whether code is audited, but who is auditing the auditor's dependencies? When your autonomous trading agent has signing authority and a Claude-co-authored commit history, the attack never has to touch the chain at all. It just needs npm install.
FAQ
What is PromptMink? PromptMink is a North Korean supply chain campaign named by ReversingLabs in April 2026. It used two-layer npm packages — a clean "bait" package like @solana-launchpad/sdk that silently pulled a malicious second-layer payload, @validate-sdk/v2, which exfiltrated wallet credentials, SSH keys, and source code.
Did Anthropic or Claude actually create malware? No. The model did not write malicious code; it accepted a plausible-looking dependency for a coding task. The failure was pipeline configuration — an agent with authority to add dependencies and run install scripts, with no pre-merge malware or reputation gate.
What was the Mastra attack? On June 17, 2026, North Korea's Sapphire Sleet hijacked the dormant npm account "ehindero" and republished 140+ packages in the @mastra AI-agent framework in 88 minutes. Each carried a typosquat dependency, easy-day-js, with a postinstall dropper that targeted 166 cryptocurrency wallet extensions.
How do I know if I was affected? Audit your lockfiles for the flagged package names (@validate-sdk/v2, @solana-launchpad/sdk, easy-day-js), run a malware-focused dependency scanner, and rotate .env values, SSH keys, and API tokens on any machine that ran npm install during the compromise windows.
Why are autonomous crypto agents the prime target? They sit directly next to private keys, API tokens, and cloud credentials. Unit 42 tracked 37 campaigns and 497 malicious packages aimed at AI-agent tooling in the first half of 2026 — the highest-value, lowest-effort attack surface in the ecosystem today.
Sources for further reading: ReversingLabs — Claude adds malware to crypto agent (https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto), Microsoft Security Blog — Mastra npm supply chain compromise (https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/), and Cloud Security Alliance — PromptMink research note (https://labs.cloudsecurityalliance.org/research/csa-research-note-promptmink-dprk-ai-generated-supply-chain).