The telebot-bot-run package versions 0.3, 0.4, and 0.5 are malicious. On import, the package fetches Python code from a Pastebin URL and executes it directly, enabling arbitrary code execution. It also contains a hardcoded Telegram bot token that starts an infinite polling thread exposing commands such as /ssh (executes shell commands), /get (sends files to the attacker), /collect (archives directories and uploads them), and /start (re-fetches and runs the remote code in the background for persistence). The package metadata is suspicious and consistent with malicious intent. This package is a typosquatting attempt masquerading as a legitimate Telegram bot library and is classified as a Remote Access Trojan (RAT).

Systems that install telebot-bot-run versions 0.3, 0.4, or 0.5 are subject to full remote code execution by attackers. The attacker can run arbitrary shell commands, exfiltrate any file, archive and upload directories, and maintain persistent control over the infected host. This compromises confidentiality, integrity, and availability of the affected system.

No official patch or remediation is currently available. Users should immediately uninstall telebot-bot-run versions 0.3, 0.4, and 0.5 if installed. Avoid installing packages from untrusted or typosquatted sources. Monitor for and remove any processes related to this package and revoke any exposed credentials. Check vendor advisories or PyPI for updates or removal of the malicious package.