MalwarePublished 31 Jul 2026Updated 5 Aug 2026

aiprepkit (PyPI) · Malicious Code

Affects aiprepkitSource GCVE Database

Malicious package : remove aiprepkit and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:12 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-11417

What to do

Remove aiprepkit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIaiprepkit	Affected =0.1.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The aiprepkit package version 0.1.2 on PyPI contains malicious code as part of a broader campaign involving multiple packages. This malicious code includes functionality to replace cryptocurrency wallet addresses with attacker-controlled ones, exfiltrate browser data, establish remote control over the victim's device, install malicious browser extensions, and execute remote commands. The campaign is linked to North Korea's "Contagious Interview" threat group and targets cryptocurrency-related projects and interview assessments by abusing dependencies. The package acts as a vector for keylogging, clipboard modification, persistence, and remote access trojan (RAT) capabilities.

Impact

The malicious code can lead to theft of cryptocurrency by replacing wallet addresses, exfiltration of sensitive browser data, unauthorized remote control of the victim's device, installation of persistent malicious browser extensions, and potential keylogging and clipboard data theft. This compromises user privacy, financial assets, and system integrity.

Defensive guidance

Users should avoid installing or using this package and any related dependencies identified in the campaign. Review and audit dependencies in cryptocurrency-related projects or interview assessment tools to ensure they are not pulling in malicious packages. Monitor for suspicious activity consistent with the described malicious behaviors.

Summary

The aiprepkit PyPI package version 0.1.2 is part of a malicious campaign where some packages contain command and control (C2) configurations and malicious functionality, while others provide fake functionality but silently execute malicious actions from dependencies. The malicious code replaces copied cryptocurrency wallet addresses with attacker-controlled addresses downloaded from a C2 server, exfiltrates browser data, installs malicious browser extensions, and enables remote control over the infected device. This campaign is consistent with tactics, techniques, and procedures (TTPs) attributed to North Korea's "Contagious Interview" group. The malicious packages are used as dependencies in cryptocurrency projects or interview assessment tools to facilitate infection and data theft.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 31 Jul 2026, 22:10 UTC

Technical details

References

Community reviews