Malicious code in zmaker (PyPI)

A coordinated malicious package campaign was discovered on PyPI consisting of five interdependent packages designed to steal data from Telegram Desktop installations. The campaign, identified as 2025-04-zscaner, used a modular architecture where each package served a specific function in the attack chain.\n\nThe attack flow begins with "pyapiepo," a cover package providing useless features while importing the core malicious package "zscaner." When zscaner is imported, it automatically executes functions that initiate the data theft process. The "reqinstall" package ensures the requests library is available and provides directory tree scanning capabilities. The "zmaker" package builds archives from collected files, while "zsender" handles exfiltration to a remote location and provides configuration deobfuscation functions.\n\nTogether, these packages search for the Telegram Desktop folder, archive user data stored there, and exfiltrate it to an attacker-controlled remote server. The malicious code was intentionally included as a dependency chain, making it difficult for users to identify the threat.\n\nThe campaign was identified and credited to the OpenSSF's malicious-packages repository, which tracks confirmed malicious packages across package ecosystems.