- Endor Labs reports that the PyPI package pyronut copied pyrogram's listing and added a runtime backdoor. Two hardcoded attacker accounts could run Python and shell commands on victim hosts.
- The backdoor needs no outside server, so network monitoring has little to flag. Commands and results travel inside Telegram chats.
- All three versions were quarantined the day they were published. Teams should check for pyronut and meval, pin dependencies with hashes, and vet forks.
Most supply chain defences ask whether a package looks wrong. The pyronut case poses a harder problem. A package can look right, and behave right, until someone sends it a message.
The trap was a copy, not a typo
Endor Labs reported on a malicious Python package called pyronut. It posed as pyrogram, a toolkit developers use to build Telegram bots. Endor Labs puts pyrogram at about 370,000 downloads a month.
The author pasted pyrogram's project description into the new listing, word for word. The GitHub address on the listing leads to a page that does not exist.
The two names are too different for a classic typo-squatting attack. Few people would mistype one as the other. The author took real code, added hidden code and published the result under a new name. The researchers describe it as a tampered copy of a real project.
They think it was likely promoted through social engineering and community channels, such as Telegram groups, developer forums or tutorials. The report gives no evidence of how far that promotion reached.
How the backdoor works
Many malicious packages run their payload at install time. Pyronut waited.
The attacker edited Client.start(), the method that launches a Telegram client. Every time a client starts, that method now loads a hidden file, pyrogram/helpers/secret.py. The real pyrogram repository does not contain this file.
The call sits inside a bare try/except: pass block. If the backdoor fails, the error is swallowed and the app carries on. Nothing looks broken.
Once loaded, the file adds hidden message handlers. They obey only two hardcoded attacker accounts.
The /e command runs Python code inside the live client, using a library called meval. The /shell command hands text to /bin/bash -c. That lets the attacker run any command on the host.
Two filters reject forwarded messages and messages sent through inline bots. That stops a third party from replaying a captured command.
The code also skips installation when the client belongs to one of the attacker's own accounts. Endor Labs reads this self-exclusion as a clear sign of deliberate intent.
The product was the control channel
Here is the idea worth keeping. The attacker did not need a server of their own.
Commands arrive as Telegram messages. Results go back to the same chat. Output longer than Telegram's 4,096-character limit is sent as a file, then deleted from disk.
That design has a cost for defenders. Setting up the backdoor sends no odd traffic out. It contacts no attacker-run domain and leaves no trace in DNS lookups, the internet's address book. Network monitoring has little to catch.
Detection then depends on what the attacker does next. A /shell command that downloads a file or opens a reverse shell leaves network and process traces. A /e command that quietly reads Telegram messages leaves none.
The bot's owner would see it only by reading the bot's message history.
Think of a burglar who copies your front-door key instead of digging a tunnel. Your alarms watch the walls, and the door opens normally.
What the evidence does and does not show
Pyronut had a very short life. Only three versions ever appeared, numbered 2.0.184, 2.0.185 and 2.0.186, and every one carried the backdoor. Endor Labs says all three were published, identified and quarantined on March 18, 2026.
Endor Labs rates the chance of exploitation as relatively low. The attack window lasted a few hours. The attacker also had to trigger payloads by hand.
The report does not say how many machines installed the package.
The researchers add a note on cheap disguises. A copied description and a dead repository link could still fool developers, or software agents, that install packages without checking the source.
Questions for your team
First, does anyone run Telegram bots on our infrastructure? Search dependency files for pyronut and for meval. Endor Labs says pyronut pulls in meval as a required dependency.
Second, who approves forks? Endor Labs advises comparing a fork against its upstream project. An unreachable repository is a warning sign. So is a copied description with no changelog.
Third, do we pin dependencies with lockfiles and cryptographic hashes? Do our monitoring tools flag bash processes started from inside Python?
If pyronut turns up, Endor Labs advises removing it and rebuilding the virtual environment from a known-good state. Treat every credential the process could reach as exposed.
Rotate API keys, SSH keys and database passwords. End all Telegram sessions and revoke Bot API tokens.
A package that copies a trusted name needs no clever disguise. It needs only someone who does not check.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Endor Labs.
