MAL-2025-192991

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyrogrem/MAL-2025-192991.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192991
Published
2025-12-31T11:49:56Z
Modified
2026-01-12T23:53:40.671359Z
Summary
Malicious code in pyrogrem (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (42a10da9545ede038913b53b3619d36a94708a854536263f6a97c5d4d30a9b65)

The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-10-speedd-testing-bot

Reasons (based on the campaign):

  • rat

  • Downloads and executes a remote malicious script.

  • typosquatting

Database specific 
{
    "iocs": {
        "urls": [
            "https://pastebin.com/raw/xAT1vudj"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "source": "kam193",
            "import_time": "2025-12-31T12:48:17.899020337Z",
            "versions": [
                "0.2"
            ],
            "sha256": "f2a47f17686bdf2b77519a89496de4816d996011cbeed112fbdb08cc8aecf219"
        },
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "source": "kam193",
            "import_time": "2025-12-31T15:38:00.893369103Z",
            "versions": [
                "0.2"
            ],
            "sha256": "42a10da9545ede038913b53b3619d36a94708a854536263f6a97c5d4d30a9b65"
        },
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "source": "kam193",
            "import_time": "2026-01-12T23:35:38.660791041Z",
            "versions": [
                "0.2"
            ],
            "sha256": "80b1f5a2130bd4018be07c47b2a064167b882d153e03f43fc08ff747b8646704"
        }
    ]
}
References
Credits

Affected packages

PyPI / pyrogrem

Package

Name
pyrogrem
View open source insights on deps.dev
Purl
pkg:pypi/pyrogrem

Affected ranges

Affected versions

0.*

0.2

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyrogrem/MAL-2025-192991.json"