Malicious code in vtranalytic (PyPI)
The PyPI package 'vtranalytic' versions 9.0.1 and 9.0.4 contains malicious code that implements a remote-administration toolkit controlled via a Telegram bot. It allows execution of arbitrary system commands, creation of OS users, privilege changes, and file upload/download on the host. The package also harvests sensitive data such as Telegram bot tokens, SSH keys, and saved credentials from the host and exfiltrates them to the attacker. The package metadata indicates an anonymous and deceptive publication. This threat enables full remote control of affected hosts by the attacker possessing the bot token.
AI Analysis
Technical Summary
The 'vtranalytic' package on PyPI (versions 9.0.1 and 9.0.4) is a malicious package masquerading as a data analytics tool but actually implements a full remote-administration toolkit (RAT) controlled through a Telegram bot. It polls the Telegram Bot API to receive commands that execute arbitrary system commands via subprocess.run, create OS users, modify sudo and RDP privileges, and transfer files. It includes a BotFinder routine that scans common directories and Windows drives for configuration files to extract Telegram bot tokens and other secrets using regex patterns. Additional commands allow exfiltration of harvested SSH keys, saved credentials, and other bot tokens back to the attacker. The package's metadata is fake, indicating anonymous and deceptive publication. This enables an attacker with the bot token to fully control the compromised host and steal sensitive secrets.
Potential Impact
Hosts running the affected versions of the 'vtranalytic' package are fully compromised, allowing attackers to execute arbitrary system commands, escalate privileges, create users, and exfiltrate sensitive data including credentials and bot tokens. This results in complete remote control of the host and potential lateral movement or further compromise within the environment.
Mitigation Recommendations
No official patch or remediation is currently available. Users should immediately uninstall the 'vtranalytic' package versions 9.0.1 and 9.0.4 if installed. Avoid installing packages from untrusted or unknown sources on PyPI. Monitor for suspicious Telegram bot activity and unauthorized system commands. Since this is a malicious package, removal and host investigation are critical.
Malicious code in vtranalytic (PyPI)
Description
The PyPI package 'vtranalytic' versions 9.0.1 and 9.0.4 contains malicious code that implements a remote-administration toolkit controlled via a Telegram bot. It allows execution of arbitrary system commands, creation of OS users, privilege changes, and file upload/download on the host. The package also harvests sensitive data such as Telegram bot tokens, SSH keys, and saved credentials from the host and exfiltrates them to the attacker. The package metadata indicates an anonymous and deceptive publication. This threat enables full remote control of affected hosts by the attacker possessing the bot token.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'vtranalytic' package on PyPI (versions 9.0.1 and 9.0.4) is a malicious package masquerading as a data analytics tool but actually implements a full remote-administration toolkit (RAT) controlled through a Telegram bot. It polls the Telegram Bot API to receive commands that execute arbitrary system commands via subprocess.run, create OS users, modify sudo and RDP privileges, and transfer files. It includes a BotFinder routine that scans common directories and Windows drives for configuration files to extract Telegram bot tokens and other secrets using regex patterns. Additional commands allow exfiltration of harvested SSH keys, saved credentials, and other bot tokens back to the attacker. The package's metadata is fake, indicating anonymous and deceptive publication. This enables an attacker with the bot token to fully control the compromised host and steal sensitive secrets.
Potential Impact
Hosts running the affected versions of the 'vtranalytic' package are fully compromised, allowing attackers to execute arbitrary system commands, escalate privileges, create users, and exfiltrate sensitive data including credentials and bot tokens. This results in complete remote control of the host and potential lateral movement or further compromise within the environment.
Defensive Guidance
No official patch or remediation is currently available. Users should immediately uninstall the 'vtranalytic' package versions 9.0.1 and 9.0.4 if installed. Avoid installing packages from untrusted or unknown sources on PyPI. Monitor for suspicious Telegram bot activity and unauthorized system commands. Since this is a malicious package, removal and host investigation are critical.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-11156
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6a735741bf8831d539154c8b
Added to database: 08/05/2026, 15:31:13 UTC
Last enriched: 08/05/2026, 17:00:02 UTC
Last updated: 09/18/2026, 05:05:13 UTC
Views: 30
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.