vtranalytic

GHSA-29jr-g2qh-hj97

Malicious code in vtranalytic (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 9.0.1`

## Source: amazon-inspector (ebce016051a9e9cb604067185042ce49c7426aa1ac01aa606e430c4d1120eec7)
Package implements a Telegram-bot-driven remote administration tool that gives whoever holds the configured bot token full control of the installer's host. A polling loop calls the Telegram getUpdates API and dispatches received messages as shell commands through subprocess.run (SystemAnalyzer.execute_analysis), exposing a documented `run` command to execute arbitrary system commands. Additional handlers (`findbot`/`getallbots`) walk the filesystem (`/`, `/home`, `/root`, `/etc`, `/var/www`, `/opt`, `/usr/local`, `/tmp`, Windows drive roots and user profile directories), read.py/.json/.conf/.cfg/.env/.ini files, and regex-extract third-party Telegram bot tokens (`BOT_TOKEN`, `API_TOKEN`, `TELEGRAM_TOKEN`, `[0-9]+:[A-Za-z0-9_-]+`), returning them to the remote operator. File and credential exfiltration handlers (`getfile`, `getdir`, `findget`, `getsystem`, `getconfig`, `getpasswords`, `getsshkeys`, `rdpall`) read arbitrary installer paths — including SSH keys and stored credentials — and upload them to the operator's Telegram chat via requests.post to api.telegram.org sendDocument. The package advertises itself as a 'Complete VPS Control System' with 168+ admin commands including user creation and firewall modification.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/0c11afc7acc22b6ae6dcd1d9e05bf37368cc773e/osv/malicious/pypi/vtranalytic/MAL-2026-11156.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/0c11afc7acc22b6ae6dcd1d9e05bf37368cc773e/osv/malicious/pypi/vtranalytic/MAL-2026-11156.json
- https://pypi.org/project/vtranalytic/9.0.1
- https://github.com/advisories/GHSA-29jr-g2qh-hj97

Compromised versions (1)

= 9.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.