The telebot-pro package on PyPI is a malicious library that, when instantiated, spawns a background thread to steal Telegram Desktop session data, decrypts local keys, and collects private media files from user directories. It also gathers host information such as hostname, local IP, and WiFi SSID. The stolen data is XOR-obfuscated and exfiltrated via a local HTTP relay to an attacker-controlled Telegram bot. The package name mimics a legitimate Telegram bot API library but performs unauthorized data theft unrelated to Telegram bot functionality.