The catalogai package (version 0.1.2) is involved in a malicious campaign where some dependencies (e.g., cognikit, aiassistcore) contain command-and-control (C2) configurations and malware functionality. Other packages like aichannel provide fake functionality while silently executing malicious actions from dependencies. The malware replaces cryptocurrency wallet addresses with attacker-controlled addresses, exfiltrates browser data, installs malicious browser extensions, and establishes remote access to the victim's device. The campaign's indicators of compromise align with those attributed to North Korea's "Contagious Interview" campaign, suggesting targeted use in malicious interview assessments or cryptocurrency projects. The malicious code includes keylogging, clipboard modification, persistence mechanisms, and limited remote command execution capabilities.

The malicious code can lead to theft of cryptocurrency by replacing wallet addresses, exfiltration of sensitive browser data, unauthorized remote control of the victim's device, installation of malicious browser extensions, and potential keylogging and clipboard data theft. This compromises user privacy, security, and financial assets.

No official patch or remediation is currently available for catalogai version 0.1.2. Users should avoid installing or using this package and its dependencies. Review and remove any installations of catalogai 0.1.2 and related malicious packages such as cognikit, aiassistcore, and aichannel. Monitor for suspicious activity related to cryptocurrency wallet address changes and browser data exfiltration. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates on remediation.