telethon2

Details

**Severity:** Critical

**Affected versions:** `> 0`

## Source: checkmarx (2f513e1bd0172cda035284efad9368870bc46158926c112ccd7fc881e6af75be)
Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials

## Source: google-open-source-security (9308df1a062441007b83384d6d5c1b9103eeae76a21599ea43aeaae5e839b243)
Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI.

The malicious code was hidden in strategicly chosen functions and would only trigger when these
functions were called. The malicious code does not automatically run on install or import,
helping the packages evade detection.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/telethon2/MAL-2023-8369.json))

**References:**
- https://checkmarx.com/blog/users-of-telegram-aws-and-alibaba-cloud-targeted-in-latest-supply-chain-attack
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/telethon2/MAL-2023-8369.json
- https://medium.com/checkmarx-security/users-of-telegram-aws-and-alibaba-cloud-targeted-in-latest-supply-chain-attack-f44e60eacbdd
- https://github.com/advisories/GHSA-g99q-2vgh-229p

Compromised versions (1)

• > 0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.