MAL-2026-18742: Malicious code in fhqiouhq (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (50625c43075a763e4420504dcbcc8b14236874f2924ec20eabcf5d7b45b0a274) During import, package exfiltrates sensitive Telegram files to a remote location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-reqnest
Reasons (based on the campaign):
- files-exfiltration
- target:telegram
- typosquatting
Affected Software
Event History
Frequently Asked Questions
When does the malicious behavior occur?
The package exfiltrates sensitive Telegram files during import, so exposure can occur when code imports the package rather than only when a specific function is called.
What data is targeted?
The reported target is sensitive Telegram files, which are sent to a remote location.
Who is most likely to be exposed?
Users or environments that installed and imported the PyPI package fhqiouhq are the directly affected population. The campaign is also identified as typosquatting, so users who intended to install a similarly named package may be at risk.