MAL-2025-2967

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/heroku-tl/MAL-2025-2967.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-2967
Published
2025-03-08T07:34:12Z
Modified
2025-12-31T02:54:07.267316Z
Summary
Malicious code in heroku-tl (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (8a78aff2389300306864bb3d44e1ac70675e128845a4d734dae5ffbc39076b93)

Clone of a legit Telegram client, with a hidden code that, under some conditions, can attempt to destroy the Linux OS.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-03-heroku-tl

Reasons (based on the campaign):

  • clones-real-package

  • action-hidden-in-lib-usage

Database specific 
{
    "iocs": {
        "urls": [
            "https://banlist.heroku-ub.top/get_ids"
        ],
        "domains": [
            "banlist.heroku-ub.top",
            "heroku-ub.top"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "reversing-labs",
            "id": "RLMA-2025-01965",
            "versions": [
                "3.2.0",
                "3.2.1",
                "3.2.2",
                "3.2.5"
            ],
            "import_time": "2025-03-31T07:07:05.679080988Z",
            "modified_time": "2025-03-28T13:05:43Z",
            "sha256": "0a8f4fc0a5d0503ac09d15275006031ce30676e8778cddddd61d8fd257fd3518"
        },
        {
            "source": "kam193",
            "id": "pypi/2025-03-heroku-tl/heroku-tl",
            "import_time": "2025-12-02T22:30:55.242078481Z",
            "modified_time": "2025-03-08T07:34:12Z",
            "sha256": "f65785e45b1a1412bb45fd3f8bbc75a9ba4709d4749e07b8db315d28c58cc1f7",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ]
        },
        {
            "source": "kam193",
            "id": "pypi/2025-03-heroku-tl/heroku-tl",
            "import_time": "2025-12-02T23:07:18.265054874Z",
            "modified_time": "2025-03-08T07:34:12Z",
            "sha256": "8a78aff2389300306864bb3d44e1ac70675e128845a4d734dae5ffbc39076b93",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "ECOSYSTEM"
                }
            ]
        },
        {
            "source": "kam193",
            "id": "pypi/2025-03-heroku-tl/heroku-tl",
            "versions": [
                "2.1.0",
                "2.1.1",
                "2.2.2",
                "2.5.0",
                "2.5.1",
                "2.6.0",
                "2.8.0",
                "2.9.0",
                "3.0.0",
                "3.0.1",
                "3.1.0",
                "3.2.1",
                "3.2.0",
                "3.2.2",
                "3.2.5"
            ],
            "import_time": "2025-12-10T21:38:57.527357363Z",
            "modified_time": "2025-03-08T07:34:12Z",
            "sha256": "f582fa05d5a878f06b3d751c56ce9c8231144aa385b567532baf91452d6af91c"
        },
        {
            "source": "kam193",
            "id": "pypi/2025-03-heroku-tl/heroku-tl",
            "versions": [
                "2.1.0",
                "2.1.1",
                "2.2.2",
                "2.5.0",
                "2.5.1",
                "2.6.0",
                "2.8.0",
                "2.9.0",
                "3.0.0",
                "3.0.1",
                "3.1.0",
                "3.2.0",
                "3.2.1",
                "3.2.2",
                "3.2.5"
            ],
            "import_time": "2025-12-30T22:39:04.095546063Z",
            "modified_time": "2025-03-08T07:34:12Z",
            "sha256": "e0f9dcd6289d0a3933488f9c5affeaaebd78d6ad3eb20d542b1e2782c068ca90"
        }
    ]
}
References
Credits

Affected packages

PyPI / heroku-tl

Package

Name
heroku-tl
View open source insights on deps.dev
Purl
pkg:pypi/heroku-tl

Affected ranges

Affected versions

2.*

2.1.0
2.1.1
2.2.2
2.5.0
2.5.1
2.6.0
2.8.0
2.9.0

3.*

3.0.0
3.0.1
3.1.0
3.2.0
3.2.1
3.2.2
3.2.5