Malicious Pyronut Package Compromises Telegram Bots via RCE

A malicious Python package named 'pyronut' has been identified on the Python Package Index (PyPI), posing a significant threat to developers of Telegram bots. This package masquerades as a legitimate alternative to the widely used 'pyrogram' framework, which has approximately 370,000 monthly downloads. By copying the entire project description of pyrogram, the threat actor has created a malicious fork that allows for remote code execution (RCE) on both the Telegram session and the underlying host system. Developers who inadvertently install this package could expose their bots and systems to unauthorized access and control by attackers. The current status of the threat is active, with researchers urging immediate caution among developers using Telegram bot frameworks. No specific CVEs have been reported yet, but the implications of this attack vector are severe.

Key Points: • The 'pyronut' package impersonates the legitimate 'pyrogram' framework. • It allows remote code execution on compromised Telegram bots and userbots. • Developers are advised to avoid installing unverified packages from PyPI.