# DPRK "PromptMink" campaign uses AI agents to insert @validate-sdk/v2 dependency

> ReversingLabs traced a DPRK Famous Chollima / UNC1069 campaign that began with `@hash-validator/v2` in Sept 2025 and evolved through Feb 28, 2026 to insert `@validate-sdk/v2` as the malicious dependency of benign-looking "bait" SDKs aimed at AI coding agents. One AI-authored commit pulled `@solana-launchpad/sdk` into a crypto trading repo. Phase 4 in March 2026 used Rust NAPI modules and 85MB Node SEA bundles to exfiltrate full source trees. 300+ malicious package versions across 60+ unique packages observed.

- Published: 2026-04-29
- Last updated: 2026-06-10
- Severity: high
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: npm, PyPI
- Scope: 10 packages, 36 compromised versions
- Tags: credential-theft, crypto-wallet-drain, infostealer, prompt-injection
- Threat actor: Famous Chollima / UNC1069 (DPRK)
- Also known as: PromptMink, Contagious Interview successor
- Detected by: ReversingLabs, GitHub Advisory Database
- Incident ID: multi-2026-04-29-promptmink-validate-sdk

## Affected packages (10)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@hash-validator/v2](https://dependencywatch.io/package/npm/@hash-validator/v2) | npm |  |
| [@meme-sdk/trade](https://dependencywatch.io/package/npm/@meme-sdk/trade) | npm | 1.0.0, 1.0.1 |
| [@pumpfun-ipfs/sdk](https://dependencywatch.io/package/npm/@pumpfun-ipfs/sdk) | npm |  |
| [@solana-ipfs/sdk](https://dependencywatch.io/package/npm/@solana-ipfs/sdk) | npm |  |
| [@solana-launchpad/sdk](https://dependencywatch.io/package/npm/@solana-launchpad/sdk) | npm |  |
| [@solmasterv3/solana-metadata-sdk](https://dependencywatch.io/package/npm/@solmasterv3/solana-metadata-sdk) | npm |  |
| [@validate-ethereum-address/core](https://dependencywatch.io/package/npm/@validate-ethereum-address/core) | npm | 1.0.3, 1.0.4, 1.0.5, 1.0.6 |
| [@validate-sdk/v2](https://dependencywatch.io/package/npm/@validate-sdk/v2) | npm | 1.22.11, 1.22.12, 1.22.13, 1.22.14, 1.22.15, 1.22.16, 1.22.17, 1.22.18, 1.22.19, 1.22.20, 1.22.21, 1.22.22, 1.22.23, 1.22.24, 1.22.25, 1.22.26, 1.22.27, 1.22.28, 1.22.29, 1.22.30, 1.22.31 |
| [@validator-sdk/pubkey](https://dependencywatch.io/package/npm/@validator-sdk/pubkey) | npm | 1.0.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8 |
| [scraper-npm](https://dependencywatch.io/package/pypi/scraper-npm) | PyPI | 1.0.4 |

## What happened

ReversingLabs published the **PromptMink** write-up on April 29, 2026, attributing a long-running multi-phase campaign to North Korea's `Famous Chollima` / `UNC1069` cluster. The campaign began in September 2025 with `@hash-validator/v2` as the malicious dependency and evolved through Feb 28, 2026 into the longer-lived `@validate-sdk/v2` line, eventually spanning 300+ malicious versions across 60+ unique packages.

The novelty is the delivery shape: rather than typosquatting directly, the operators built deliberately benign-looking "bait" SDKs targeting AI coding agents - `@meme-sdk/trade`, `@solana-launchpad/sdk`, `@validate-ethereum-address/core`, `@pumpfun-ipfs/sdk` and similar Web3 / Solana names - that declare `@validate-sdk/v2` (or its predecessor) as a transitive dependency. The malicious payload thus arrives one level down the dependency tree, where lockfile review is less attentive.

ReversingLabs documented at least one AI-agent-authored commit that pulled `@solana-launchpad/sdk` into a real crypto-trading repo. That single commit then transitively pulled in the malicious validator. This is the first publicly-documented case of an AI coding agent's own commit being the vector for a North Korean supply-chain implant.

Phase 4 of the campaign (March 2026) moved up the technical ladder: Rust NAPI native modules plus 85 MB Node Single-Executable-Application (SEA) bundles capable of exfiltrating an entire source tree, not just credentials. If you allow AI agents to add dependencies, require human review on any commit that touches `package.json` or `package-lock.json`, and audit lockfiles for the named bait packages.

## 2026-06-10 update - npm security-holds the bait SDKs

On 2026-06-10 npm-support pushed `0.0.1-security` security-hold replacements over three of the PromptMink bait names that had not previously been delisted, and the GitHub Advisory Database filed standalone CWE-506 advisories for each:

- `@meme-sdk/trade` - `GHSA-4c2m-9v9c-75xv` covers the original two releases `1.0.0` and `1.0.1` (both 2025-10-24)
- `@validate-ethereum-address/core` - `GHSA-c29q-842f-rcjc` covers `1.0.3`, `1.0.4` (2025-10-31) and `1.0.5`, `1.0.6` (2025-11-25)
- `@validator-sdk/pubkey` - `GHSA-w9ch-gj3p-2cj9` covers the entire eight-release batch published on 2025-10-31 (`1.0.0`, `1.0.2`, `1.0.3`, `1.0.4`, `1.0.5`, `1.0.6`, `1.0.7`, `1.0.8`)

Third-party news write-ups on 2026-06-10 grouped these GHSAs with the unrelated `dbmux` maintainer takeover and the `SeedSweep` `aicrypto-xzggg` drop and framed them as a single "coordinated wave". The naming, mechanics, and timeline all match the PromptMink bait packages first disclosed by ReversingLabs in April; the new identifier is the npm security-hold and the GHSA-level attribution, not a fresh actor. Treat the new GHSAs as supporting evidence for this incident rather than a separate event.

## Impact

- Crypto wallet and SSH credential theft via AI-agent-authored commits
- 300+ malicious package versions across 60+ unique packages observed
- Source-tree exfiltration of entire projects via Rust NAPI modules

## What to do

1. Block and audit for the named bait/payload packages in lockfiles and agent history
2. Require human review on dependency-changing commits authored by AI agents
3. Rotate SSH keys, AWS keys, .npmrc credentials, and wallet seeds for any affected dev box

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [ReversingLabs: PromptMink - AI agents and DPRK malware](https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto) - ReversingLabs
- [GHSA-4c2m-9v9c-75xv: Malicious code in @meme-sdk/trade](https://github.com/advisories/GHSA-4c2m-9v9c-75xv) - GitHub
- [GHSA-c29q-842f-rcjc: Malicious code in @validate-ethereum-address/core](https://github.com/advisories/GHSA-c29q-842f-rcjc) - GitHub
- [GHSA-w9ch-gj3p-2cj9: Malicious code in @validator-sdk/pubkey](https://github.com/advisories/GHSA-w9ch-gj3p-2cj9) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-04-29-promptmink-validate-sdk
Markdown version: https://dependencywatch.io/incident/multi-2026-04-29-promptmink-validate-sdk.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).