The 'telegram-helper' package on PyPI, specifically versions 0.1.1 and 0.1.2, contains hidden malicious code that initiates a Telegram bot to exfiltrate sensitive session files and browser cookies from the victim's machine. The package includes functionality to execute remote commands, likely limited to a specific set, effectively acting as a remote access trojan (RAT). Its primary targets are Telegram users, leveraging the Telegram bot infrastructure for command and control and data exfiltration. This campaign is categorized as malicious with clear intent to steal information.

The malicious package can lead to unauthorized remote command execution on the victim's machine and exfiltration of sensitive data such as session files and browser cookies. This compromises user privacy and security, potentially allowing attackers to hijack sessions or access sensitive accounts. There is no indication of active exploitation in the wild yet.

Users should immediately uninstall the 'telegram-helper' package versions 0.1.1 and 0.1.2 if installed. Avoid using this package from PyPI as it contains malicious code. Since no official patch or fix is available, the best mitigation is to remove the package and monitor for any suspicious activity. Verify dependencies and sources before installing Python packages.