Malicious code in deepface-weights (PyPI)
deepface-weights, a malicious package published to PyPI, contains code that exfiltrates Telegram session credentials on import. The package impersonates the legitimate deepface library but contains only credential-stealing functionality.
- Disclosed
- Last updated
- Blast radius
- Any Python environment that imported deepface-weights; Telegram accounts associated with exfiltrated session files.
- Ecosystems
- Attack vectors
- Affected entities
- deepface-weightsMalicious package on PyPI containing infostealer code
deepface-weights is a malicious package published to PyPI that performs credential exfiltration targeting Telegram users. Upon import, the package spawns a daemon thread that polls every 10 seconds for the file data/telethon_market_userbot.session in the current working directory.\n\nWhen a Telethon session file is detected, the malware POSTs the file contents along with the local system username (via os.getlogin()) to a hardcoded webhook endpoint at https://webhook.site/730d2d03-5c78-4e0a-88df-9d8466b7e8aa. Telethon .session files contain authenticated Telegram credentials, enabling full account takeover of the associated Telegram account.\n\nThe package uses deceptive metadata (placeholder author email rozuvu@example.com, generic description) and a name resembling the legitimate deepface face-recognition library, but ships no legitimate functionality. Source code comments in Russian identify the destination as the attacker's infrastructure. The campaign was identified and attributed by OpenSSF's malicious-packages project.
Indicators of compromise
- Packages
- deepface-weights
- Domains
- webhook.site
Remediation
- Immediately uninstall deepface-weights from all Python environments
- Audit pip install logs and dependency trees to identify all systems that may have imported the package
- For any Telegram accounts that may have been compromised, change the password and enable two-factor authentication
- Revoke any Telegram sessions and review active sessions for unauthorized access
- Monitor for unauthorized Telegram account activity
- If Telethon session files were present, regenerate them after securing the account
- Use dependency scanning tools to prevent similar typosquatting attacks
Sources
- GitHub Advisory GHSA-2cw8-w83p-pj7v · GitHub Advisory Database
Cite this entry
"Malicious code in deepface-weights (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-deepface-weights-pypi-06h2z8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in scrambleeeer (PyPI)
The PyPI package scrambleeeer contains malicious code that establishes a reverse shell to a hardcoded location, allowing remote command execution on affected systems. The package was identified as part of a malicious campaign and has been documented by the OpenSSF.
2026 08 ScrambleeerPyPICompromised package - containedcritical
Malicious code in reqcrypts (PyPI)
The reqcrypts package on PyPI contains malicious code that implements a hidden backdoor. The package masquerades as an HTTP request library but secretly monitors responses for specific fields and executes their content without user knowledge.
2026 08 ReqcryptPyPICompromised packageMalicious commit - containedcritical
Malicious code in boto4 (PyPI)
A malicious package named boto4 was published to PyPI containing embedded executable code capable of cryptomining, remote command execution, persistence, data exfiltration, and worm-style propagation controlled via Telegram bot. The package was identified and attributed to the 2026-08-boto4 campaign by the OpenSSF.
2026 08 Boto4PyPICompromised package - containedcritical
Malicious code in scrambleeer (PyPI)
The scrambleeer package on PyPI contained malicious code that establishes a reverse shell to a hardcoded location, enabling arbitrary command execution on affected systems. The malicious package was identified and cataloged by the OpenSSF malicious-packages project.
2026 08 ScrambleeerPyPICompromised package