Malicious code in deepface-weight (PyPI)
The PyPI package deepface-weight contained malicious code that exfiltrated Telegram session files on import, granting attackers full access to associated Telegram accounts. The package was a typosquat of the legitimate deepface ML library with no actual machine-learning functionality.
- Disclosed
- Last updated
- Blast radius
- Any user who installed and imported the deepface-weight package; Telegram accounts associated with telethon session files in the installer's working directory.
- Ecosystems
- Attack vectors
- Affected entities
- deepface-weightMalicious PyPI package mimicking the legitimate deepface library
The deepface-weight package published to PyPI contained intentionally malicious code designed to steal Telegram authentication credentials. Upon import, the package spawned a background daemon thread that polled the installer's working directory for data/telethon_market_userbot.session files for approximately 10 minutes and exfiltrated them via HTTP POST to a hardcoded webhook.site endpoint (https://webhook.site/d6ea9c5b-4a85-4e59-9397-2bb5f9407c87).\n\nTelethon session files contain live authentication material that grants full access to the associated Telegram account. The malicious code included a variable explicitly named evil_server_url with a Russian-language comment identifying it as the attacker's server, indicating deliberate intent.\n\nThe package was a typosquat of the popular deepface machine-learning library but contained no ML code. Author metadata consisted of placeholder text (asdqwdasdqwdasd) and a disposable email address at playboot.com, further indicating malicious intent.\n\nThe incident was identified and reported through the OpenSSF malicious-packages repository (MAL-2026-14158) and subsequently published as GitHub Advisory GHSA-5j48-33h2-gvwg.
Indicators of compromise
- Packages
- deepface-weight
- Domains
- webhook.site
Remediation
- Immediately uninstall deepface-weight from all systems where it was installed
- Revoke or reset any Telegram accounts that may have had session files in the installer's working directory
- Audit logs for any unauthorized Telegram account activity during the period the package was installed
- Use the legitimate deepface package (from PyPI) instead of deepface-weight
- Review PyPI package names carefully before installation to avoid typosquats
- Monitor for similar typosquatting attempts targeting popular ML libraries
Sources
- GitHub Advisory GHSA-5j48-33h2-gvwg · GitHub Advisory Database
Cite this entry
"Malicious code in deepface-weight (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-deepface-weight-pypi-k5ay6t
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in scrambleeeer (PyPI)
The PyPI package scrambleeeer contains malicious code that establishes a reverse shell to a hardcoded location, allowing remote command execution on affected systems. The package was identified as part of a malicious campaign and has been documented by the OpenSSF.
2026 08 ScrambleeerPyPICompromised package - containedcritical
Malicious code in reqcrypts (PyPI)
The reqcrypts package on PyPI contains malicious code that implements a hidden backdoor. The package masquerades as an HTTP request library but secretly monitors responses for specific fields and executes their content without user knowledge.
2026 08 ReqcryptPyPICompromised packageMalicious commit - containedcritical
Malicious code in boto4 (PyPI)
A malicious package named boto4 was published to PyPI containing embedded executable code capable of cryptomining, remote command execution, persistence, data exfiltration, and worm-style propagation controlled via Telegram bot. The package was identified and attributed to the 2026-08-boto4 campaign by the OpenSSF.
2026 08 Boto4PyPICompromised package - containedcritical
Malicious code in scrambleeer (PyPI)
The scrambleeer package on PyPI contained malicious code that establishes a reverse shell to a hardcoded location, enabling arbitrary command execution on affected systems. The malicious package was identified and cataloged by the OpenSSF malicious-packages project.
2026 08 ScrambleeerPyPICompromised package