MAL-2026-1498

    Dashboard / Malicious Package / MAL-2026-1498

    MAL-2026-1498

    Published: 17 Mar 2026Last Modified: 17 Mar 2026

    Summary: Malicious code in telegramdatas (PyPI)

    Details: Source: kam193 (742799f83f7140514aa9a55c3f3efb5142ab1eaef68317a40e23a8f261e22b71) During import, an infostealer embedded as package resource is started. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-flowfix Reasons (based on the campaign): - obfuscation - infostealer - Downloads and executes a remote executable.

    References: https://app.any.run/tasks/da14db45-34c9-465f-80e5-394d433cd21d, https://app.any.run/tasks/3a6f9054-be6c-4b33-bcf7-d7504e1f4d52, https://bad-packages.kam193.eu/pypi/package/telegramdatas

    Affected packages

    Package

    Name: telegramdatas

    Purl: pkg:pypi/telegramdatas

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.0
    MAL-2026-1498 | CVE-DB