The aiassistcore PyPI package version 0.1.2 is part of a malicious campaign where dependencies contain command-and-control configurations and malicious functionality. This includes clipboard modification to replace cryptocurrency wallet addresses, browser data exfiltration, installation of malicious browser extensions, keylogging, persistence mechanisms, and limited remote command execution capabilities. The campaign is associated with North Korea's "Contagious Interview" group and uses these packages as dependencies in malicious projects to silently execute harmful actions.

Users who install or use aiassistcore version 0.1.2 risk having their cryptocurrency wallet addresses replaced with attacker-controlled addresses, leading to potential financial theft. Additionally, attackers can exfiltrate sensitive browser data, gain persistent remote access to the device, install malicious browser extensions, and capture keystrokes, compromising user privacy and security.

No official patch or remediation is currently documented for aiassistcore version 0.1.2. Users should avoid installing or using this version of the package. Review and remove the package if already installed. Monitor for updates from the package maintainers or PyPI for any official fixes. Since this is not a cloud service, remediation depends on user action. Patch status is not yet confirmed — check the vendor advisory or PyPI for current remediation guidance.