Malicious npm Dependency Targets Crypto Wallets via AI Commit

A malicious npm dependency was discovered that is linked to an AI-assisted code commit, targeting cryptocurrency wallets. The attack exploits the software supply chain by injecting malicious code into a legitimate-looking npm package, which then exfiltrates sensitive data including crypto wallet keys. The incident was publicly disclosed on 2026-05-01, though the exact discovery date is not specified.

The attack vector is supply chain compromise, where the threat actor used an AI-assisted commit to introduce the malicious dependency. The malicious package likely mimics a legitimate library, tricking developers into including it in their projects. Once installed, it steals crypto wallet keys and other sensitive data from the affected systems. No specific threat actor or CVE references are mentioned in the article.

No post-incident details such as regulatory actions, litigation, or ransom payments are provided in the article.