The pullgetsage package on PyPI contains malicious code that exfiltrates Telegram Desktop session data. Upon import, it archives the Telegram Desktop 'tdata' directory, which holds session keys, and sends it to a hardcoded external endpoint. This enables full account takeover of the installer's Telegram account. The malicious behavior is disguised with misleading identifiers and silent error handling. The package falsely claims to be a library filled with books, unrelated to Telegram functionality.