cyber.hendryadrian.com
Threat Research · reversinglabs.com

ReversingLabs Details PromptMink Supply-Chain Campaign Targeting AI Coding Agents

· Original article ↗

Summary

ReversingLabs describes PromptMink, a malicious npm and PyPI supply-chain campaign attributed to Famous Chollima, tracing its evolving payloads from obfuscated JavaScript to Rust add-ons and detailing secret theft, project exfiltration and SSH backdoors.

Key points

  • ReversingLabs found that the malicious npm package @validate-sdk/v2 was added to an autonomous crypto trading agent in a commit co-authored by Claude Opus; the package stole secrets from its environment.
  • The campaign used legitimate-looking first-layer packages as bait to introduce replaceable second-layer malicious packages, allowing the operators to swap payloads after detection or removal.
  • PromptMink payloads evolved from obfuscated JavaScript to a PyPI package, Node Single Executable Applications and compiled Rust N-API add-ons.
  • Payloads searched for .env and .json files and collected system and user information; later versions also compressed and exfiltrated project source code and added SSH public keys for remote access.
  • ReversingLabs attributed the campaign to North Korean-linked Famous Chollima based on infrastructure, targeting and operational patterns. Its researchers identified more than 300 package versions across 60 unique packages over seven months.
  • The researchers recommend analyzing dependencies, supplying coding agents with curated threat intelligence and monitoring CI/CD pipelines.

Article Details

Attack Vectors
  • Malicious first-layer npm packages posed as useful cryptocurrency utilities and imported disposable second-layer packages containing the payload; typosquatting and names resembling legitimate packages were used to make them convincing.
  • A malicious dependency was added to the openpaw-graveyard crypto trading agent in a commit co-authored by Claude Opus, according to the article.
  • Payloads evolved from obfuscated JavaScript to a PyPI package, JavaScript bundled with Node executables as SEA binaries, and compiled Rust N-API addons.
  • Payloads recursively searched for .env and .json files, collected system and user information, and in later versions compressed and exfiltrated entire projects and source code.
  • Payloads added attacker SSH public keys to victim machines to enable remote access: Linux support was described first, with Windows support added in a later Rust payload.
  • Binary embedding and obfuscation were used to make malicious code harder to detect and less visible to tools that parse source files.
Defensive Notes
  • Perform detailed static analysis of all project dependencies, including transitive dependencies and binary payloads.
  • Provide LLM coding agents with curated threat intelligence about packages and their dependencies before they recommend or add components.
  • Use CI/CD integrations to monitor pipelines and GitHub Actions for malicious dependencies and build risks.
  • Use manual analyst review alongside automated detections; the article identifies Spectra Assure Community as a source of package analysis and workflow integrations.
  • Exercise caution when accepting LLM-generated edits that introduce new dependencies.

Indicators of compromise

TypeIndicatorContext
DOMAINapi-sub[.]jrodacooker[.]devListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINapi[.]bensaru[.]siteListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINapi[.]fivefingerz[.]devListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINapi[.]mywalletsss[.]storeListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINapi[.]soladify[.]funListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINblxrbn[.]comListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINchangelog[.]restListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINclob-polymarket[.]comListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINghostraper[.]topListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINlog[.]pricesheet[.]inkListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINlogger[.]clob[.]healthListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINmywalletsss[.]storeListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINnavigatorshub[.]comListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINpolblxpnl[.]spaceListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINpolygon-rpc[.]comListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINpolymarket-clob[.]comListed by ReversingLabs as a C2 domain used in the campaign.
DOMAINrpc-amoy[.]polygon[.]technologyListed by ReversingLabs among the campaign's C2 domains.
DOMAINvalidator[.]unoDedicated campaign domain used by PromptMink for exfiltration.
DOMAINwinstonjs[.]siteListed by ReversingLabs as a C2 domain used in the campaign.
IPV445[.]61[.]161[.]146Listed by ReversingLabs as C2 infrastructure used in the PromptMink campaign.
IPV445[.]8[.]22[.]144Listed by ReversingLabs as C2 infrastructure used in the PromptMink campaign.
IPV445[.]8[.]22[.]52Listed by ReversingLabs among the campaign's C2 IP addresses.
SHA1ae4fe9f9a4f099de9132eb3346abcdd96dbeb39dSHA-1 listed as an indicator for the malicious scraper-npm 1.0.4 PyPI package.
SHA1e79ce589913bb8c5743bf0e55e075e2260c7a915SHA-1 listed among the malicious PyPI package indicators for scraper-npm 1.0.4.

MITRE ATT&CK

T1005 · Data from Local SystemPayloads collected local sensitive files and, in later Rust versions, compressed and exfiltrated entire projects and source code.T1027 · Obfuscated Files or InformationThe campaign used obfuscated JavaScript, a base64-encoded exfiltration URL, and payloads embedded in executables to hinder detection.T1036 · MasqueradingCampaign packages used typosquatting and names or descriptions resembling legitimate packages, including validator-like naming, to deceive users and coding agents.T1082 · System Information DiscoveryThe malware collected system and user details including OS, public and local IP addresses, and username.T1083 · File and Directory DiscoveryPayloads recursively scanned directories, including locations such as /home, /Users, and Windows drives, to find files for collection.T1098 · Account ManipulationPayloads added the attackers' public SSH key to victim SSH configuration files to enable remote access.T1195 · Supply Chain CompromiseA malicious second-layer npm dependency was introduced into the openpaw-graveyard crypto trading agent, compromising the project through its software supply chain.T1552.001 · Credentials In FilesPromptMink recursively searched for .env and .json files and collected secrets found in those files.T1567 · Exfiltration Over Web ServiceCollected files and system information were exfiltrated to campaign web infrastructure, including validator[.]uno and the listed validation API paths.

Threat Actors

Void DokkaebiReversingLabs assesses that Famous Chollima is behind PromptMink, citing campaign infrastructure, targeting, similarities to prior DPRK campaigns, and operational patterns; the article presents this as an assessment supported by indicators rather than conclusive proof.

Malware

PromptMinkReversingLabs researchers uncovered a supply-chain campaign dubbed PromptMink in which a malicious npm package @validate-sdk/v2 (and related packages) was introduced as a dependency—often via AI-generated commits—and

Vendors

AnthropicThe commit was co-authored by Anthropic’s Claude Opus large language model (LLM).ReversingLabsReversingLabs researchers uncovered a supply-chain campaign dubbed PromptMink in which a malicious npm package @validate-sdk/v2 (and related packages) was introduced as a dependency—often via AI-generated commits—and

Products

Claude OpusThe commit was co-authored by Anthropic’s Claude Opus large language model (LLM).npmReversingLabs researchers uncovered a supply-chain campaign dubbed PromptMink in which a malicious npm package @validate-sdk/v2 (and related packages) was introduced as a dependency—often via AI-generated commits—andPyPIPromptMink evolved across multiple payload forms (obfuscated JS, SEA binaries, PyPI Python package, and Rust N-API compiled addons) to improve stealth, cross-platform capability, and exfiltration scope.Spectra Assure CommunityDefensive recommendations include static analysis of all dependencies, integrating curated threat data into LLM coding agents, CI/CD monitoring, and using tools like Spectra Assure Community to detect malicious packages.

Tools

Claude CodeTwo integrations that stand out due to the nature of this compromise are Spectra Assure Community MCP Server and Claude Code skills for Spectra Assure.Gemini CLIBy adding RL’s MCP server to the Gemini CLI, the LLM can easily fetch RL data about @solana-launchpad/sdk package and clarify to the user why they shouldn’t use it in their code (Figure 15).Spectra AnalyzeMalicious JS payload was carved out of the binary we found in the new version of @validate-sdk/v2 with RL’s Spectra Analyze, which leverages RL’s Spectra Core to perform a deep binary analysis of the file.Spectra Assure Community MCP ServerTwo integrations that stand out due to the nature of this compromise are Spectra Assure Community MCP Server and Claude Code skills for Spectra Assure.Spectra CoreMalicious JS payload was carved out of the binary we found in the new version of @validate-sdk/v2 with RL’s Spectra Analyze, which leverages RL’s Spectra Core to perform a deep binary analysis of the file.

Industries

Software developmentHere’s what you need to know about PromptMink — including a deep analysis and IOCs — and what your team can do to secure your software development.

Related Articles