infogram-bot versions 1.0.0 to 1.9.0 implement a Telegram bot that accepts text messages from remote users and executes them as shell commands on the host via subprocess.check_output(cmd, shell=True). It exposes handlers that allow full remote shell access and data exfiltration, including walking the working directory, zipping and uploading files in chunks, streaming requested files back to Telegram, and leaking environment variables. The package includes placeholder maintainer metadata consistent with low attribution and was deliberately designed to hack machines and steal files and credentials.

An attacker with access to the Telegram bot can execute arbitrary shell commands on the host with the privileges of the running process, effectively gaining full remote control. The attacker can also exfiltrate files and environment variables, leading to potential data breaches and credential theft. This creates a severe security risk including unauthorized access, data loss, and persistence on the compromised system.

No official patch or remediation is currently documented. Users should immediately uninstall the infogram-bot package and avoid running it in any environment. Since this is a malicious package, do not trust or use any versions listed. Monitor for any unauthorized Telegram bots or suspicious processes and remove them. Check for any signs of compromise if this package was installed.