North Korean hacker group embeds malicious code generated by Claude into the encrypted trading tool openpaw-graveyard

ME News Report, May 1 (UTC+8), security research organization ReversingLabs discovered that a malicious npm package named PromptMink was embedded into the open-source encrypted trading project openpaw-graveyard through code submissions generated by Anthropic’s Claude Opus AI model, leading to the theft of users’ crypto wallet credentials and system keys. The attack originates from the North Korean state-sponsored hacker group Famous Chollima, which has been distributing malicious npm packages since September 2025, employing a two-layer strategy: the first layer is a “decoy” package without malicious code, and the second layer carries the actual malicious payload. When the second-layer package is taken down, the attackers release a replacement version on the same day. After multiple iterations, the malware has evolved into a compiled Rust payload that, once installed, steals crypto wallet credentials, system information, project source code, and implants SSH keys on Linux and Windows systems to maintain persistent remote access. (Source: PANews)