← Back to feed
2026-05-06 Supply ChainNation StateMalicious Tool TLP:CLEAR

PromptMink: North Korean Supply Chain Campaign Weaponizes AI Coding Agents via LLM Optimization Abuse—Claude Opus Compromised to Install Malicious Dependencies

Date: 2026-05-06
Tags: supply-chain, nation-state, malicious-tool

Executive Summary

ReversingLabs attributes PromptMink to Famous Chollima, a North Korean state-sponsored threat group also linked to the "graphalgo" campaign targeting crypto developers. Claude Opus co-authored a Feb. 28, 2026, commit to the openpaw-graveyard crypto trading agent. The commit added @solana-launchpad/sdk as a dependency, which silently pulled in @validate-sdk/v2 — the malicious payload package. This marks the first documented instance of AI coding agents being weaponized to install malicious dependencies in autonomous workflows via LLM optimization abuse.

Campaign Summary

FieldDetail
Campaign / MalwarePromptMink
AttributionFamous Chollima (North Korea) (confidence: high)
TargetCryptocurrency developers, AI coding agents, blockchain projects
VectorMalicious npm packages disguised as legitimate crypto utilities; two-layer supply chain attack where bait packages contain no malicious code but import malicious payload packages as dependencies; LLM Optimization (LLMO) abuse via detailed documentation to trick AI agents into recommending packages
Statusactive
First Observed2025-09-01 (initial activity); 2026-02-28 (Claude Opus compromise)

Detailed Findings

The PromptMink campaign appears to have started last September with two malicious packages called @hash-validator/v2 and @solana-launchpad/sdk. The SDK was used as a bait package with legitimate functionality intended to be discovered by developers, while hash-validator, a dependency for the SDK, contained a JavaScript infostealer. PromptMink steals .env and .json files, crypto wallet credentials, system information, and — in its latest Rust-based variant — entire project source trees. It also installs attacker SSH keys for persistent remote access on Linux and Windows. After thorough analysis, ReversingLabs researchers named the campaign PromptMink and attributed it to a coordinated supply chain attack linked to Famous Chollima, a North Korean-linked threat group. This is the same actor previously connected to the Contagious Interview campaign, which targeted software developers through fake job interviews and code assessments designed to deliver malicious packages. The repository history showed the dependency had been added in a commit co-authored by Claude Opus. "This transforms the technique from social engineering to a combination of LLM Optimization (LLMO) abuse and knowledge injection," the researchers concluded.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195Malicious packages inserted into npm registry targeting AI agents
Compromise Software Dependencies and Development ToolsT1195.001Injection of malicious packages as transitive dependencies
Credential AccessT1110Steals .env files, wallet credentials, API keys via infostealer payload
PersistenceT1098Installation of SSH keys for persistent remote access

IOCs

Domains

_IOCs sourced from ReversingLabs blog post and InfoWorld coverage. Malicious packages have been rotated; defenders should monitor dependency trees for unexpected transitive pulls from bait packages._

Full URL Paths

ipfs-url-validator.vercel.app (exfiltration endpoint for early variants)

Splunk Format

"ipfs-url-validator.vercel.app (exfiltration endpoint for early variants)"

Package Indicators

@solana-launchpad/sdk (bait package, no malicious code)
@validate-sdk/v2 (payload, infostealer)
@hash-validator/v2 (early variant, JavaScript infostealer)
aes-create-ipheriv (rotated payload)
jito-proper-excutor (rotated payload)
jito-sub-aes-ipheriv (rotated payload)
scraper-npm (PyPI variant, February 2026)

Detection Recommendations

Monitor npm and PyPI registries for packages with crypto-related names but suspiciously broad dependency lists, especially those listing popular packages alongside niche cryptographic utilities. Implement Software Composition Analysis (SCA) tools to flag transitive dependencies pulled in by less-known packages. For AI-generated code, inspect commit messages and code comments for LLM-generated artifacts (excessive comments, emojis, placeholder language). Require code review approval for dependencies added by AI coding agents, especially in high-risk domains like finance/crypto. Monitor for .env file exfiltration patterns in logs. Track SSH key installations outside normal CI/CD workflows. Implement supply chain security policies blocking automatic adoption of new package versions without review quarantine period.

References