{"id":"MAL-2026-13686","title":"Malicious code in chaintest (PyPI)","summary":"Malicious code in chaintest (PyPI)","severity":"none","vendor":"chaintest","product":"chaintest","ecosystem":"pip","affected":["chaintest"],"published":"2026-08-10","updated":"2026-08-10","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-13686","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/chaintest"}],"tags":["osv","pip"],"ingestedAt":"2026-08-10T19:16:47.939Z","slug":"MAL-2026-13686","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (4923d010301ea929207d0a1c87e876ca24203fdff90bad313efc3df58879555a)\nThe package contains a cryptocurrency infostealer that exfiltrates information from browsers (including cryptowallet extensions, synced extensions, local storage) and standalone applications (password managers, cryptowallets). The code achieves persistence via different methods on different platforms, and runs a keylogger that modifies the copied cryptocurrency addresses with addresses controlled by the attacker. Malicious code is also prepared to retrieve commands to execute from C2, exfiltrate SSH keys, and install malicious extensions in browsers.\n\nThe code shares some similarities with campaign 2026-07-cognikit attributed to the DPRK \"Contagious Interview\" campaign.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-chaintest\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - clipboard-stealing\n\n\n - dependency-confusion\n\n\n - crypto-related\n\n\n - keylogger\n\n\n - exfiltration-browser-data\n\n\n - exfiltration-crypto\n\n\n - clipboard-modify\n\n\n - persistence\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - exfiltration-ssh-keys\n\n\n - files-exfiltration\n\n\n - rat\n\n\n## Affected packages\n\n- `chaintest`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}