Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets

A supply-chain campaign named PromptMink abused npm packages (notably package@validate-sdk/v2) to deliver infostealing malware that exfiltrated secrets and accessed cryptocurrency wallets; researchers attribute the activity to North Korean APT Famous Chollima and observed a layered delivery strategy, cross-platform evolution from JS to compiled/Rust payloads, and persistent backdoor capabilities over a multi-month, multi-package campaign.