The chaintest PyPI package version 0.1.0 embeds a cryptocurrency-focused infostealer that collects browser data, cryptowallet extensions, local storage, password managers, and standalone cryptowallet applications. It maintains persistence through platform-specific methods and includes a keylogger that modifies clipboard cryptocurrency addresses to redirect funds to attacker-controlled addresses. The malware can receive and execute remote commands, exfiltrate SSH keys, and install malicious browser extensions. This campaign is linked to the DPRK 'Contagious Interview' campaign (2026-07-cognikit) and demonstrates multiple malicious behaviors including dependency confusion, clipboard stealing and modification, and remote access trojan capabilities.

This malicious package compromises user security by stealing sensitive cryptocurrency-related data and credentials, potentially leading to theft of cryptocurrency assets and unauthorized access to victim systems. The keylogger and clipboard modification can redirect cryptocurrency transactions to attacker-controlled addresses. Remote command execution and SSH key exfiltration increase the risk of further system compromise and lateral movement. The installation of malicious browser extensions can facilitate ongoing surveillance and data theft.

No official patch or remediation is currently available for the chaintest package version 0.1.0. Users and organizations should avoid installing or using this package. Remove any existing installations immediately and audit systems for signs of compromise. Monitor for suspicious network activity related to command-and-control communications. Check vendor advisories or trusted security sources for updates or remediation guidance. Since this is not a cloud service, remediation depends on user action.