Illicit AI-assisted commit-linked npm dependency compromises crypto wallets - SC Media

North Korean state-backed threat group Famous Chollima has published a malicious npm package as part of the PromptMink campaign. The package code commit was co-authored by Anthropic's Claude Opus AI model, according to a report from SC Media. The campaign targets cryptocurrency wallets for theft.

The malicious npm package was designed to compromise crypto wallets through supply chain attacks. The use of an AI-assisted commit, specifically from Claude Opus, marks a notable tactic where the language model contributed to the code that appears legitimate. Famous Chollima is a known threat actor associated with North Korea's cyber operations.

This incident highlights how AI tools can be exploited by state actors for offensive cyber operations. The PromptMink campaign demonstrates the increasing sophistication of supply chain attacks, leveraging AI to generate code that may evade detection. Security researchers warn that AI-assisted code commits could become more common in malware development, complicating attribution and defense efforts.