{"answers":{"affected":"1 open source package ship an affected version, including chaintest.","exploited":"There is no known exploitation of MAL-2026-13686 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13686 is a malicious package in chaintest, published on 10 Aug 2026."},"fix_prompt":"MAL-2026-13686 is a malicious package: chaintest (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13686/ (Markdown: https://insights.sbomify.com/MAL-2026-13686/index.md)","id":"MAL-2026-13686","markdown":"https://insights.sbomify.com/MAL-2026-13686/index.md","name":"MAL-2026-13686","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence are available to identify a specific installer-harm mechanism (no named exfiltration endpoint, no install-time fetch-and-execute path, no credential-read path, no lifecycle-script behavior) in this record. Without a specific observed behavior to cite, the package's disposition is unresolved.\n\nThe package contains a cryptocurrency infostealer that exfiltrates information from browsers (including cryptowallet extensions, synced extensions, local storage) and standalone applications (password managers, cryptowallets). The code achieves persistence via different methods on different platforms, and runs a keylogger that modifies the copied cryptocurrency addresses with addresses controlled by the attacker. Malicious code is also prepared to retrieve commands to execute from C2, exfiltrate SSH keys, and install malicious extensions in browsers.\n\nThe code shares some similarities with campaign 2026-07-cognikit attributed to the DPRK \"Contagious Interview\" campaign.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-08-chaintest\n\nReasons (based on the campaign):\n\n - infostealer\n\n - clipboard-stealing\n\n - dependency-confusion\n\n - crypto-related\n\n - keylogger\n\n - exfiltration-browser-data\n\n - exfiltration-crypto\n\n - clipboard-modify\n\n - persistence\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n - exfiltration-ssh-keys\n\n - files-exfiltration\n\n - rat","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in chaintest (PyPI)","id":"MAL-2026-13686","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"chaintest","purl":"pkg:pypi/chaintest","source":"MAL-2026-13686"}],"products":null,"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13686/"}