telebot-pro (PyPI) · Malicious Code
Affects telebot-proSource GCVE Database
Malicious package : remove telebot-pro and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 16:58 UTC
Malicious package
Published to PyPI · OSV MAL-2026-13757
What to do
Remove telebot-pro from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPItelebot-pro | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The telebot-pro package on PyPI is a malicious library that, when instantiated, spawns a background thread to steal Telegram Desktop session data, decrypts local keys, and collects private media files from user directories. It also gathers host information such as hostname, local IP, and WiFi SSID. The stolen data is XOR-obfuscated and exfiltrated via a local HTTP relay to an attacker-controlled Telegram bot. The package name mimics a legitimate Telegram bot API library but performs unauthorized data theft unrelated to Telegram bot functionality.