Malicious code in chaintest (PyPI)

The chaintest package published on PyPI contained embedded malicious code designed to steal cryptocurrency and sensitive information from infected systems. The infostealer targets browser extensions (including cryptowallet extensions), local storage, password managers, and standalone cryptocurrency wallets.\n\nThe malware implements multiple persistence mechanisms across different platforms and includes a keylogger that intercepts and modifies cryptocurrency addresses copied to the clipboard, replacing them with attacker-controlled addresses. Additional capabilities include remote command execution via C2 communication, SSH key exfiltration, and malicious browser extension installation.\n\nThe malicious code shares similarities with the 2026-07-cognikit campaign attributed to the DPRK "Contagious Interview" operation. The package was identified and reported by the OpenSSF malicious-packages project.