Malicious code in vtranalytic (PyPI)

The vtranalytic package published on PyPI contained intentionally malicious code disguised as a "Complete VPS Control System." The package implements a polling loop that communicates with a Telegram bot API, allowing a remote operator to execute arbitrary system commands and exfiltrate sensitive data from infected systems.

The malicious functionality includes multiple command handlers: the run command executes arbitrary shell commands via subprocess.run; findbot and getallbots handlers traverse the filesystem (including /, /home, /root, /etc, /var/www, /opt, /usr/local, /tmp, and Windows drive roots) searching for and extracting Telegram bot tokens from configuration files; and credential exfiltration handlers (getfile, getdir, findget, getsystem, getconfig, getpasswords, getsshkeys, rdpall) read and upload SSH keys, stored credentials, and arbitrary files to the attacker's Telegram chat.

The package advertised itself as offering 168+ admin commands including user creation and firewall modification, indicating intentional deception. The malicious code was identified by the OpenSSF malicious-packages project and reported through GitHub Security Advisories.

Any system that installed this package had its security compromised, with the attacker gaining remote command execution and credential harvesting capabilities.