Security · 2h ago
Trojanized PyPI packages steal files from Telegram bot servers
Since November, attackers have uploaded malicious PyPI packages mimicking Pyrogram, a Telegram bot library. The packages allow remote file theft from compromised servers. Developers who installed the trojanized forks are at risk of data exposure.
Meridian48 take
The attack exploits trust in open-source ecosystems, highlighting the need for rigorous package verification even for popular libraries.
Read the full reporting
Malicious PyPI packages give hackers control of Telegram bot servers →
Bleeping Computer
pypisupply-chain-attack