The aiprepkit PyPI package version 0.1.2 is part of a malicious campaign where some packages contain command and control (C2) configurations and malicious functionality, while others provide fake functionality but silently execute malicious actions from dependencies. The malicious code replaces copied cryptocurrency wallet addresses with attacker-controlled addresses downloaded from a C2 server, exfiltrates browser data, installs malicious browser extensions, and enables remote control over the infected device. This campaign is consistent with tactics, techniques, and procedures (TTPs) attributed to North Korea's "Contagious Interview" group. The malicious packages are used as dependencies in cryptocurrency projects or interview assessment tools to facilitate infection and data theft.

The malicious code can lead to theft of cryptocurrency by replacing wallet addresses, exfiltration of sensitive browser data, unauthorized remote control of the victim's device, installation of persistent malicious browser extensions, and potential keylogging and clipboard data theft. This compromises user privacy, financial assets, and system integrity.

No official patch or remediation is currently available for aiprepkit version 0.1.2. Users should avoid installing or using this package and any related dependencies identified in the campaign. Review and audit dependencies in cryptocurrency-related projects or interview assessment tools to ensure they are not pulling in malicious packages. Monitor for suspicious activity consistent with the described malicious behaviors. Patch status is not yet confirmed — check the vendor advisory or trusted threat intelligence sources for updates.