MAL-2025-192991

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyrogrem/MAL-2025-192991.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192991
Published
2025-12-31T11:49:56Z
Modified
2026-07-20T06:32:29Z
Summary
Malicious code in pyrogrem (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (42a10da9545ede038913b53b3619d36a94708a854536263f6a97c5d4d30a9b65)

The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-10-speedd-testing-bot

Reasons (based on the campaign):

  • rat

  • Downloads and executes a remote malicious script.

  • typosquatting

Database specific 
{
    "iocs": {
        "domains": [
            "server-unlock-hack.onrender.com"
        ],
        "urls": [
            "https://pastebin.com/raw/xAT1vudj"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "import_time": "2025-12-31T12:48:17.899020337Z",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "sha256": "f2a47f17686bdf2b77519a89496de4816d996011cbeed112fbdb08cc8aecf219",
            "source": "kam193",
            "versions": [
                "0.2"
            ]
        },
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "import_time": "2025-12-31T15:38:00.893369103Z",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "sha256": "42a10da9545ede038913b53b3619d36a94708a854536263f6a97c5d4d30a9b65",
            "source": "kam193",
            "versions": [
                "0.2"
            ]
        },
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "import_time": "2026-01-12T23:35:38.660791041Z",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "sha256": "80b1f5a2130bd4018be07c47b2a064167b882d153e03f43fc08ff747b8646704",
            "source": "kam193",
            "versions": [
                "0.2"
            ]
        },
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "import_time": "2026-01-18T23:07:34.010954865Z",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "sha256": "6181ece57a9c1548b9704d49e5b6afda906bef2d22f772e339d62646292c5b25",
            "source": "kam193",
            "versions": [
                "0.2"
            ]
        },
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "import_time": "2026-02-26T09:49:02.330177034Z",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "sha256": "260cb344d468cb743830b840b69604fb473f942bcb19d285be3950aa6a40b8f5",
            "source": "kam193",
            "versions": [
                "0.2"
            ]
        },
        {
            "id": "pypi/2025-10-speedd-testing-bot/pyrogrem",
            "import_time": "2026-07-20T06:05:22.55767011Z",
            "modified_time": "2025-12-31T11:49:56.752417Z",
            "sha256": "9768b3bcb5aa252d419895ca6c14403092d50a3b41fa65451432f28835481b62",
            "source": "kam193",
            "versions": [
                "0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / pyrogrem

Package

Name
pyrogrem
View open source insights on deps.dev
Purl
pkg:pypi/pyrogrem

Affected ranges

Affected versions

0.*
0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyrogrem/MAL-2025-192991.json"