Supply chain · pip · High

Critical Malicious PyPI Package 'chaintest' Steals Credentials and Crypto

Threat Engine Auto-Feed · data current as of 2026-08-10

The PyPI package `chaintest` version 0.1.0 contains a cryptocurrency infostealer, keylogger, and remote access trojan (RAT) capabilities. It exfiltrates sensitive data, modifies clipboard contents, and establishes persistence, posing a critical risk to systems that installed it.

  • Package: pip / chaintest
  • Affected versions: = 0.1.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The `chaintest` package (version 0.1.0) on PyPI was identified as malicious, containing code designed to steal information, log keystrokes, and establish remote control. It specifically targets browser data, password managers, and cryptocurrency wallets, and can exfiltrate SSH keys.

How the attack works

This supply-chain attack involves a malicious package masquerading as legitimate software. Upon installation, it executes code to collect sensitive data from the host system, including credentials, browser information, and cryptocurrency details. It also modifies clipboard data to redirect cryptocurrency transactions and attempts to maintain a persistent presence on the compromised machine, potentially allowing for further remote command execution.

Who's exposed

Profiles most at risk

  • Development teams using Python and PyPI
  • Organizations with CI/CD pipelines that pull PyPI packages
  • Users of cryptocurrency applications, password managers, and browsers on systems where `chaintest` was installed

Conditions that increase exposure

  • Projects with unpinned dependencies that might automatically update to malicious versions
  • Build systems or developer machines that installed `chaintest` version 0.1.0
  • Environments lacking robust software supply chain security practices

Blast-radius scenarios

  • An attacker gains access to sensitive credentials, including those for cryptocurrency wallets and password managers.
  • An attacker can modify clipboard contents, potentially redirecting cryptocurrency transactions.
  • An attacker establishes persistence on the compromised system, enabling further data exfiltration (e.g., SSH keys) and remote command execution.

What to do (defensive)

Detect

  • Scan dependency trees for `chaintest` version 0.1.0 in `requirements.txt`, `pyproject.toml`, or lock files.
  • Monitor network traffic for unusual outbound connections from Python environments or build agents.
  • Review system logs for suspicious process activity or persistence mechanisms created by Python packages.

Contain

  • Immediately quarantine or isolate any systems identified as having installed `chaintest` version 0.1.0.
  • Block `chaintest` version 0.1.0 from being downloaded from PyPI in internal package managers or proxies.
  • Rotate all credentials (API keys, SSH keys, user passwords) that may have been present on compromised systems.

Remediate

  • Remove `chaintest` version 0.1.0 from all affected environments and ensure it is not re-introduced.
  • Perform a thorough forensic analysis on any compromised systems to identify the full extent of data exfiltration and persistence.
  • Rebuild affected systems from trusted images or known good states after ensuring all malicious components are removed and vulnerabilities addressed.

Frontier verdict — High

Prioritize immediate detection and removal of `chaintest` version 0.1.0 due to its critical severity and broad data theft capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.