Malicious code in inlifegram (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3975a0998bf76dddc25f0138b1d4b408bb06304b3203dc1e62e0110b2b56425f) InLifeGram distributes a modified copy of the `pyrogram` Telegram client library and installs it into the top-level `pyrogram` import namespace, so `import pyrogram` after installation resolves to this fork. The fork's Client start path has been modified to lazily import a sibling module (`from. import app as secret`) and, when the authenticated account is a bot (`self.me.is_bot`), call `secret.init(self)` wrapped in a bare `except Exception: pass`. The call hands the fully authenticated client object — containing the bot token, api_id/api_hash, and MTProto auth_key — to undocumented code. The receiving `app.py` module consists of a single `exec(zlib.decompress(base64.b85decode(b'...')).decode())` over an ~11KB opaque blob, with no other functionality and an Indonesian-language header threatening anyone who removes 'credits'. The multi-layer obfuscation (base85 → zlib → exec), the silent invocation on bot authentication, and the bare-except suppression are the canonical shape of a session/token-stealing backdoor. README links a sibling project `VLife-Gram` by the same author, indicating a family of trojanized forks. Any program that installs InLifeGram and runs a Pyrogram bot will silently surrender its bot session to the hidden payload on every successful login. ## Source: kam193 (9e2d3483845391abac4b854096ffc1c7767818f9e2b02486d969ee2be0638dc9) The modified version of a Telegram bot library. The obfuscated code, launched when the user starts their own bot application, attaches malicious backdoor commands to the Telegram bot. They allow hardcoded users to execute any commands in the bot's environment. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-inlifegram Reasons (based on the campaign): - clones-real-package - obfuscation - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine. - rat - target:telegram - action-hidden-in-lib-usage - backdoor
AI Analysis
Technical Summary
The inlifegram PyPI package versions 2.1.2.8 and 2.1.2.9 have been identified as malicious. The package contains obfuscated code that, upon execution, attaches backdoor commands to a Telegram bot, allowing hardcoded users to remotely execute commands in the bot's environment. This behavior classifies the package as a remote access trojan (RAT) and a malicious clone of a legitimate package. The malicious code is hidden within the library usage, making detection more difficult.
Potential Impact
Users who install and run the affected versions of the inlifegram package risk unauthorized remote command execution by attackers with hardcoded access. This can lead to full compromise of the environment where the bot runs, potentially allowing data theft, system manipulation, or further malware deployment. The malicious functionality is specifically designed to target Telegram bot environments.
Mitigation Recommendations
No official patch or remediation has been provided for this malicious package. Users should immediately cease using versions 2.1.2.8 and 2.1.2.9 of inlifegram and remove them from their environments. It is recommended to verify the integrity and source of any Telegram bot libraries used and rely only on trusted, verified packages from official sources. Monitor for any suspicious activity related to Telegram bots and consider rotating credentials or secrets that may have been exposed.
Malicious code in inlifegram (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3975a0998bf76dddc25f0138b1d4b408bb06304b3203dc1e62e0110b2b56425f) InLifeGram distributes a modified copy of the `pyrogram` Telegram client library and installs it into the top-level `pyrogram` import namespace, so `import pyrogram` after installation resolves to this fork. The fork's Client start path has been modified to lazily import a sibling module (`from. import app as secret`) and, when the authenticated account is a bot (`self.me.is_bot`), call `secret.init(self)` wrapped in a bare `except Exception: pass`. The call hands the fully authenticated client object — containing the bot token, api_id/api_hash, and MTProto auth_key — to undocumented code. The receiving `app.py` module consists of a single `exec(zlib.decompress(base64.b85decode(b'...')).decode())` over an ~11KB opaque blob, with no other functionality and an Indonesian-language header threatening anyone who removes 'credits'. The multi-layer obfuscation (base85 → zlib → exec), the silent invocation on bot authentication, and the bare-except suppression are the canonical shape of a session/token-stealing backdoor. README links a sibling project `VLife-Gram` by the same author, indicating a family of trojanized forks. Any program that installs InLifeGram and runs a Pyrogram bot will silently surrender its bot session to the hidden payload on every successful login. ## Source: kam193 (9e2d3483845391abac4b854096ffc1c7767818f9e2b02486d969ee2be0638dc9) The modified version of a Telegram bot library. The obfuscated code, launched when the user starts their own bot application, attaches malicious backdoor commands to the Telegram bot. They allow hardcoded users to execute any commands in the bot's environment. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-inlifegram Reasons (based on the campaign): - clones-real-package - obfuscation - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine. - rat - target:telegram - action-hidden-in-lib-usage - backdoor
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The inlifegram PyPI package versions 2.1.2.8 and 2.1.2.9 have been identified as malicious. The package contains obfuscated code that, upon execution, attaches backdoor commands to a Telegram bot, allowing hardcoded users to remotely execute commands in the bot's environment. This behavior classifies the package as a remote access trojan (RAT) and a malicious clone of a legitimate package. The malicious code is hidden within the library usage, making detection more difficult.
Potential Impact
Users who install and run the affected versions of the inlifegram package risk unauthorized remote command execution by attackers with hardcoded access. This can lead to full compromise of the environment where the bot runs, potentially allowing data theft, system manipulation, or further malware deployment. The malicious functionality is specifically designed to target Telegram bot environments.
Mitigation Recommendations
No official patch or remediation has been provided for this malicious package. Users should immediately cease using versions 2.1.2.8 and 2.1.2.9 of inlifegram and remove them from their environments. It is recommended to verify the integrity and source of any Telegram bot libraries used and rely only on trusted, verified packages from official sources. Monitor for any suspicious activity related to Telegram bots and consider rotating credentials or secrets that may have been exposed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6516
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a3ef7b127e9c79719ffb930
Added to database: 06/26/2026, 22:05:37 UTC
Last enriched: 06/26/2026, 22:30:22 UTC
Last updated: 07/31/2026, 19:39:22 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.