Observed incident

Claude-assisted crypto project adds a PromptMink dependency

Reported

What happened

ReversingLabs traced a malicious dependency introduced in a Claude Opus-coauthored crypto project commit to the PromptMink credential-stealing package campaign.

Parties and reporting

AI tools and systems: Claude Opus, npm, PromptMink

Outcome

Researchers documented the dependency chain and evolving malware; the report did not establish quantified financial losses for the affected project.

Operating lesson

Verify dependency provenance and inspect transitive packages introduced by coding agents.

Evidence and limits

The agent-assisted commit occurred February 28. The broader package campaign began earlier; attribution to Famous Chollima is ReversingLabs' assessment.

Sources