The telebot-bot-run package on PyPI versions 0.3, 0.4, and 0.5 contains malicious code that executes attacker-controlled scripts on the host system. Upon import, it fetches and executes remote Python code from a mutable Pastebin URL, runs a Telegram bot with hardcoded credentials that allows remote command execution, file exfiltration, directory archiving, and persistent background execution. The package is identified as typosquatting and is designed for remote access and control of infected hosts.