The PyPI package catalogai version 0.1.2 is part of a malicious campaign involving several packages that include hidden malware. These packages contain code that replaces cryptocurrency wallet addresses with attacker-controlled ones, exfiltrates browser data, installs malicious browser extensions, and enables remote control over the victim's device. The campaign is linked to North Korea's "Contagious Interview" threat actor group and targets cryptocurrency-related projects and interview assessments. The malicious functionality includes keylogging, clipboard modification, persistence, and remote command execution.