Malicious code in zscaner (PyPI)
A coordinated malicious package campaign on PyPI targeting Telegram Desktop users. Five interdependent packages (zscaner, pyapiepo, reqinstall, zmaker, zsender) work together to locate, archive, and exfiltrate Telegram Desktop user data to a remote server.
- Disclosed
- Last updated
- Blast radius
- Users who installed zscaner and its dependency chain (pyapiepo, reqinstall, zmaker, zsender) from PyPI
- Ecosystems
- Attack vectors
- Affected entities
- zscanerPrimary malicious package; runs exfiltration logic on import
- pyapiepoCover package that imports zscaner
- reqinstallProvides directory scanning functionality
- zmakerProvides archive building functions
- zsenderProvides data exfiltration and configuration deobfuscation
A multi-package malicious campaign was discovered on PyPI designed to steal data from Telegram Desktop installations. The campaign consists of five coordinated packages that together form an infostealer:
Package roles:
- pyapiepo: A cover package providing useless features while importing the malicious zscaner package
- zscaner: The primary malicious package that executes automatically on import, orchestrating the entire exfiltration process
- reqinstall: Ensures the requests library is installed and provides directory tree scanning functionality
- zmaker: Provides archive creation functions for collected files
- zsender: Handles data exfiltration to remote servers and configuration deobfuscation
Attack flow: When any of these packages are imported, the malicious code searches for the "Telegram Desktop" folder, archives user data stored there, and exfiltrates it to an attacker-controlled remote location. The campaign was identified as part of the OpenSSF's malicious packages tracking effort.
Indicators of compromise
- Packages
- zscaner
- pyapiepo
- reqinstall
- zmaker
- zsender
Remediation
- Immediately uninstall zscaner, pyapiepo, reqinstall, zmaker, and zsender from all systems
- Audit PyPI package dependencies in your projects to identify if any of these packages were installed
- If Telegram Desktop was installed on affected systems, assume Telegram user data may have been compromised; change Telegram credentials and enable two-factor authentication
- Review network logs for outbound connections to the exfiltration endpoint identified in the malicious package
- Use package pinning and dependency scanning tools to prevent installation of malicious packages
- Monitor PyPI for similar multi-package campaigns targeting specific applications
Sources
- GitHub Advisory GHSA-7h98-3phx-875g · GitHub Advisory Database
Cite this entry
"Malicious code in zscaner (PyPI)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 21, 2026; last updated July 21, 2026. https://supplychainattack.org/incident/malicious-code-in-zscaner-pypi-13cho4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in acloud-clients (PyPI)
A multi-year malicious campaign on PyPI distributes packages that clone legitimate cloud SDK libraries (acloud-clients, AWS clients) and inject code to exfiltrate cloud credentials via hidden dependencies like time-check-server and snapshot-photo.
PyPICompromised packageMalicious commit - resolvedcritical
Malicious code in acloud-client (PyPI)
A multi-year malicious campaign on PyPI distributed packages (acloud-client, time-check-server, snapshot-photo) that clone legitimate cloud SDK packages and exfiltrate cloud credentials to remote servers. The campaign used obfuscation techniques, hiding malicious functionality in dependency chains.
PyPICompromised packageMalicious commit - resolvedcritical
Malicious code in aclient-sdk (PyPI)
aclient-sdk on PyPI contains malicious code designed to exfiltrate cloud credentials. The package is a clone of the legitimate aliyun-python-sdk-core with injected code that imports a credential-stealing dependency and exfiltrates AWS/Alibaba Cloud tokens to a remote server.
PyPICompromised packageMalicious commit - resolvedcritical
Malicious code in zmaker (PyPI)
A coordinated malicious package campaign on PyPI targeted Telegram Desktop users. Five interdependent packages (zmaker, zscaner, pyapiepo, reqinstall, zsender) worked together to locate, archive, and exfiltrate Telegram user data to a remote server.
PyPICompromised packageMalicious commit