The 'cognikit' PyPI package version 0.1.2 is part of a malicious campaign where dependencies contain command-and-control (C2) configurations and malicious code. This code replaces copied cryptocurrency wallet addresses with attacker-controlled addresses, exfiltrates browser data, installs malicious browser extensions, and establishes remote access to the victim's device. The campaign is linked to North Korea's 'Contagious Interview' threat actor group and involves keylogging, clipboard manipulation, persistence, and remote command execution. Some related packages provide fake functionality while silently executing malicious actions from dependencies. These packages are used in malicious interview assessments or cryptocurrency projects.

The malicious code can lead to theft of cryptocurrency by replacing wallet addresses, compromise of sensitive browser data, persistent remote access to the victim's device, and installation of malicious browser extensions. This can result in significant financial loss and privacy breaches for affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid using the affected version (=0.1.2) of the 'cognikit' package and audit dependencies for malicious code. Remove or replace the package if found in your environment.