Malicious code in telerape (PyPI)

The telerape package published on PyPI contained embedded malicious code designed to establish a reverse shell on infected systems. The reverse shell was placed in a PTH file, a Python mechanism that allows code execution during interpreter initialization.\n\nThe malicious payload was identified in multiple versions of the package. In the analyzed versions, the reverse shell targeted localhost, though the capability to execute arbitrary commands on the victim's machine represents a critical compromise vector.\n\nThe package was identified and attributed to the 2026-07-telerape malicious campaign by security researchers and credited to the OpenSSF's malicious-packages project. The incident demonstrates the abuse of Python's PTH file mechanism as a persistence and code execution technique.