Malicious code in zsender (PyPI)

A coordinated malicious package campaign was discovered on PyPI targeting Telegram Desktop users. The campaign consists of five interdependent packages that collectively exfiltrate sensitive data from the Telegram Desktop application.\n\nThe attack chain operates as follows: "pyapiepo" serves as a cover package providing useless features while importing "zscaner"; "zscaner" contains the core malicious logic and automatically executes a function upon import that initiates the data theft process; "reqinstall" ensures the requests library is installed and provides directory tree scanning functionality; "zmaker" builds archives from collected files; and "zsender" handles exfiltration to a remote location and provides configuration deobfuscation functions.\n\nThe malicious packages search for the "Telegram Desktop" folder, archive user data stored within it, and exfiltrate the archives to an attacker-controlled remote server. The campaign was identified and attributed to the OpenSSF's malicious-packages project (campaign identifier: 2025-04-zscaner).