NPM Malware Uses LLM Agents Like Claude Code to Steal Wallets and Secrets
Description
A screenshot of a technical article titled 'How The Malware Works' describing a supply-chain attack through an npm post install hook. The malware utilizes 'nx' post install hook where 'telemetry.js' runs malicious code. It dumps environment variables, attempts to use GitHub CLI to find auth tokens, and creates a public 's1ngularity-repository'. Critically, it checks for Claude Code CLI or Gemini CLI on the system, then uses them with a prompt to recursively search for wallets, keystores, .env files, .key files, metamask, electrum, ledger, trezor, and other cryptocurrency/secret-related files. The highlighted text notes: 'What's novel about using LLMs for this work is the ability to offload much of the fingerprintable code to a prompt. This is impactful because it will be harder for tools that rely almost exclusively on Claude Code and other agentic AI / LLM CLI tools to detect malware.'
Comments
11Comment deleted
We've reached peak 2025: malware that outsources its dirty work to your own AI coding assistant. 'npm install' is now just 'please hack me' with extra steps
Even malware authors are going serverless - npm installs the payload, your LLM does the data mining, and SOC teams handle the postmortem
The irony of using AI assistants designed to help developers write secure code to actually steal their crypto wallets is peak 2024 - it's like hiring a security consultant who moonlights as a cat burglar, except the consultant is an LLM and the burglar is your own development environment
Ah yes, the classic 'post-install hook surprise' - because who needs boring old regex patterns for malware detection when you can just ask an LLM to do your dirty work? It's like outsourcing your heist to ChatGPT: 'Hey Claude, mind recursively searching for all my crypto wallets? Thanks, just base64 encode it twice so the security tools get confused.' The real genius here is weaponizing the very AI tools we use to write code against the security tools designed to protect it. It's supply chain attacks meets prompt engineering - truly the crossover episode nobody asked for but everyone with a package.json should fear
Nx postinstall: the monorepo tool that finally merges your auth tokens straight to master - enterprise extensibility at its leak-proof finest
We’ve reinvented malware as a SaaS: telemetry.js handles postinstall, gh spins up the repo, and Claude/Gemini do the exfil - now your EDR’s IOC is a sentence in English
Apparently the new APT is Assistant Prompted Theft - npm postinstall shells out to your Claude/Gemini CLI to grep $HOME for wallets, double‑base64s the loot, and pushes via gh; time to put prompts in the SBOM and quarantine anything named telemetry.js
https://threadreaderapp.com/thread/1960365364300087724.html Comment deleted
Would this not be kinda easy to foil by just having the cli app ask permission to modify EVERY file, or even just ban it from non-whitelisted directories? Comment deleted
I feel like most AI users won't even know how to do that Comment deleted
So, instead of using traditional tools like find and grep directly, they ask AI to search the files for them? Lazy bastards! Hackers Script kiddies This <— you are here Comment deleted