MAL-2026-13686

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/chaintest/MAL-2026-13686.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13686
Published
2026-08-10T10:37:01Z
Modified
2026-08-11T12:30:11.240979634Z
Summary
Malicious code in chaintest (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c)

chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence are available to identify a specific installer-harm mechanism (no named exfiltration endpoint, no install-time fetch-and-execute path, no credential-read path, no lifecycle-script behavior) in this record. Without a specific observed behavior to cite, the package's disposition is unresolved.

Source: kam193 (4923d010301ea929207d0a1c87e876ca24203fdff90bad313efc3df58879555a)

The package contains a cryptocurrency infostealer that exfiltrates information from browsers (including cryptowallet extensions, synced extensions, local storage) and standalone applications (password managers, cryptowallets). The code achieves persistence via different methods on different platforms, and runs a keylogger that modifies the copied cryptocurrency addresses with addresses controlled by the attacker. Malicious code is also prepared to retrieve commands to execute from C2, exfiltrate SSH keys, and install malicious extensions in browsers.

The code shares some similarities with campaign 2026-07-cognikit attributed to the DPRK "Contagious Interview" campaign.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-chaintest

Reasons (based on the campaign):

  • infostealer

  • clipboard-stealing

  • dependency-confusion

  • crypto-related

  • keylogger

  • exfiltration-browser-data

  • exfiltration-crypto

  • clipboard-modify

  • persistence

  • The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

  • exfiltration-ssh-keys

  • files-exfiltration

  • rat

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-chaintest/chaintest",
            "import_time": "2026-08-10T11:28:05.349874311Z",
            "sha256": "4923d010301ea929207d0a1c87e876ca24203fdff90bad313efc3df58879555a",
            "modified_time": "2026-08-10T10:37:01.415081Z",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "import_time": "2026-08-11T12:23:07.306758567Z",
            "id": "IN-MAL-2026-017311",
            "sha256": "9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c",
            "modified_time": "2026-08-11T12:02:00Z",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ],
    "iocs": {
        "ips": [
            "204.168.151.58"
        ],
        "domains": [
            "ephmral.info"
        ]
    }
}
References
Credits

Affected packages

PyPI / chaintest

Package

Name
chaintest
View open source insights on deps.dev
Purl
pkg:pypi/chaintest

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/chaintest/MAL-2026-13686.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "chaintest-0.1.0-py3-none-any.whl",
            "hashes": {
                "sha256": "6b9043da9968104415dcc75a457ccb50e0f01f8b9829abb9a26ceaafbed698f6",
                "blake2b_256": "34b45c20be910d04b23cb92711f4eb9e34b267b9aa54a20628f7f11037a4c660",
                "md5": "caf71eaf175aa54708496b5a30c6ce23"
            }
        },
        {
            "filename": "chaintest-0.1.0.tar.gz",
            "hashes": {
                "sha256": "34be68029d55b3adf8d0f724650d3133eb3240eb9a45638dafc61c07de732c6a",
                "blake2b_256": "adc21d12a76ede89895ffb8cff4521e9f5946df471850310afb04cbac5f7b344",
                "md5": "6ad3f498d7f29a9094bf850ba146df66"
            }
        }
    ]
}