North Korean hacker group uses malicious npm packages to steal crypto wallet credentials

According to Cryptopolitan, ReversingLabs has discovered that the North Korean hacker group Famous Chollima used a malicious npm package named PromptMink to compromise the open-source crypto trading project openpaw-graveyard by submitting code generated by Anthropic's Claude Opus AI model. This allowed them to steal users' crypto wallet credentials and system keys. Since September 2025, the group has been continuously distributing malicious npm packages, employing a two-layer strategy: first releasing “decoy” packages without malicious code, then carrying out attacks through a second-layer package. After the second-layer package is taken down, replacement versions are quickly published.