Case kodane-npm-claude-drainerAI-assisted malwareWorldwide
AI-written npm package @kodane/patch-manager drains Solana wallets after 1,500 downloads
Safety researchers found a wallet drainer disguised as an npm cache manager whose code style, emojis and 'Enhanced' labels pointed to generation by Anthropic's Claude; it hid in cache folders, kept C2 persistence and swept Solana funds.
MediumAttack using AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 1, 2025
- Location
- Worldwide
- Target
- npm users with Solana wallets
- Severity
- Medium
- Triggered by
- npm user 'Kodane'
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Safety researchers found a wallet drainer disguised as an npm cache manager whose code style, emojis and 'Enhanced' labels pointed to generation by Anthropic's Claude; it hid in cache folders, kept C2 persistence and swept Solana funds.
Impact: Over 1,500 downloads; the public C2 server logged wallet thefts, but total losses were not disclosed
Who triggered it
Actor: npm user 'Kodane'
Attribution: Published by the npm account Kodane; Claude authorship inferred by Safety from stylistic markers, not confirmed; timestamps suggested a UTC+5 origin
Motive: Cryptocurrency theft
How it happened
Attack vector: npm postinstall script dropping hidden payloads on Windows, macOS and Linux with a background C2 connection and a Solana drainer script
Root cause: Automatic postinstall execution in npm and reviewers trusting clean-looking, well-documented AI-generated code
Timeline
- @kodane/patch-manager published; 19 versions follow within two days
- npm flags and removes the package after more than 1,500 downloads
- Safety publishes analysis attributing the code style to Claude
Response
Package removed from npm; Safety published indicators of compromise
Current status: Resolved
Sources (open in a new tab)
- The Hacker News thehackernews.com
- Security Affairs securityaffairs.com
Cite this case
AI-written npm package @kodane/patch-manager drains Solana wallets after 1,500 downloads. AI Threat Watch, case kodane-npm-claude-drainer, Aug 1, 2025. https://aithreat.io/cases/kodane-npm-claude-drainer/
Permanent link: https://aithreat.io/cases/kodane-npm-claude-drainer/