Sign in Subscribe

AI-Generated npm Package Stole Cryptocurrency, Downloaded 1,500+ Times

AI-Generated npm Package Stole Cryptocurrency, Downloaded 1,500+ Times

Security researchers at Safety have uncovered a malicious npm package, likely AI-generated, that was designed to steal cryptocurrency wallet data from unsuspecting developers.

Key Details

  • Package Name: @kodane/patch-manager (now removed from npm)
  • Disguise: Posed as a performance optimization tool, claiming to provide “advanced license validation and registry optimization for high-performance Node.js apps”
  • Published: July 28, 2025, by user Kodane
  • Downloads: 1,500+ before removal

How the Attack Worked

The malicious behavior was triggered by a post-install script, which ran automatically when the package was installed:

  • Stealth Payload: Malicious files were hidden in OS-specific hidden directories across Windows, Linux, and macOS
  • C2 Server: The package connected to a remote server at
    sweeper-monitor-production.up.railway[.]app
    (only two infected devices were detected during analysis)
  • Wallet Theft: The malware scanned for local cryptocurrency wallets (e.g., MetaMask, Phantom) and siphoned funds to a hardcoded Solana address

Was It AI-Generated?

Researchers suspect the package was authored by an AI model, most likely Claude by Anthropic, based on these telltale signs:

  • Heavy use of emojis in comments and logs
  • Verbose console messages, typical of AI-generated JavaScript
  • Overly descriptive comments and redundant phrasing
  • Writing style in README.md closely matched known Claude patterns
  • Frequent use of the term "Enhanced" in variable names (e.g., enhancedStealthWalletDrainer)

Why It Matters

This case highlights an alarming shift: AI is now being used to generate malware that appears polished, functional, and trustworthy—lowering the technical barrier for cybercriminals.

  • Growing Threat: Attackers can produce sophisticated code faster using AI tools
  • Open-Source Risk: Even a small package with minimal adoption can result in significant financial damage

Recommendations

  • Audit dependencies before installation—especially lesser-known packages
  • Review post-install scripts for suspicious behavior
  • Secure crypto wallets using hardware wallets, allowlist-only transfers, and transaction alerts

This incident marks another disturbing chapter in the intersection of AI and cybercrime, where automation is being weaponized to scale attacks across open-source ecosystems with minimal effort.

Read next