Executive Summary
CSA describes PromptMink, where npm package documentation was crafted to appeal to LLM dependency evaluators, leading AI coding agents to install malicious packages that exfiltrate env files, wallet credentials and source code.
What Happened
This CSA research note describes the PromptMink campaign, where npm package documentation was engineered to look attractive to LLM-based dependency evaluators, leading AI coding agents to install malicious dependencies. The report says the payload could exfiltrate environment files, wallet credentials, system information, and project source trees, making it directly relevant to AI supply chain risk.
Affected Products
- npm
Vulnerability / Attack Technique
Package documentation targeting AI agents
Technical Mechanism
As reported, documentation was optimized to persuade AI agents to choose the package.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Attackers now write for AI readers. RealGround analysis: coding agents should not add dependencies without human review.
Recommended Controls
- Require approval for agent-added dependencies
- Keep secrets out of agent workspaces
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
Cloud Security Alliance: https://labs.cloudsecurityalliance.org/research/csa-research-note-dprk-promptmink-llm-agent-supply-chain-202/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.