North Korean Developer Gains Access to Waves Protocol Codebase

According to PANews, a North Korean developer has reportedly gained elevated access to the Keeper-Wallet codebase of the Waves Protocol. The account, identified as 'AhegaoXXX,' has been pushing updates to a dormant codebase since May 2025. This account is linked to a North Korean IT outsourcing organization. A code review revealed that one of the updates included a feature that could send wallet logs and runtime errors to an external database, potentially compromising mnemonic phrases and private keys. Although this branch has not been merged, the attacker managed to publish six outdated malicious NPM packages by controlling the account of former Waves engineer Maxim Smolyakov.
Security reports indicate that this incident marks a shift in North Korean hackers' tactics from ordinary outsourcing infiltration to direct control of codebases. It is recommended that development teams enhance supply chain defenses, including auditing contributor permissions, cleaning up dormant accounts, and monitoring repository redirects. While the number of affected software downloads remains low, Waves users updating Keeper-Wallet face the risk of credential leaks