MAL-2026-18741: Malicious code in ajfhiuqhfqgwerhuqnfqh (PyPI)
Published Nov 6, 2026
·Updated
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (e1da9c2dae077cc96d13ab9964ca2887742f0dc1bc2a3e92f4b0bf9b6d0e3b04) During import, package exfiltrates sensitive Telegram files to a remote location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-reqnest
Reasons (based on the campaign):
- files-exfiltration
- target:telegram
- typosquatting
Affected Software
1 affected component
pip/ajfhiuqhfqgwerhuqnfqh=0.1.0
Event History
Nov 6, 2026
Advisory Published
via OSV·10:12 PM
Data Sourced
via OSV·10:12 PM
DescriptionAffected Software
Frequently Asked Questions
1
How could a user be exposed to this package?
The package is identified as part of a typosquatting campaign, so users may be exposed if they install it after mistyping or selecting a similarly named dependency.
2
Does the package need to be explicitly run after installation for the malicious behavior to occur?
The reported exfiltration occurs during import. Any environment that imports the package may therefore expose sensitive Telegram files to a remote location.