aiosendletter

GHSA-hc2r-77jq-mjrx

Malicious code in aiosendletter (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.2.0`

## Source: kam193 (4e81e3b63bbe719f6d0bdd42930bb2f3235b8e41cbacf449743bb7dca67c9f08)
Package hides code to exfiltrate files. Most releases target unclear files, but some reveal the goal to exfiltrate sensitive Telegram data.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-aiosendletter


Reasons (based on the campaign):


 - files-exfiltration


 - target:telegram

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b4f738c2719bc533615f8c2b6a5ab143ced7546b/osv/malicious/pypi/aiosendletter/MAL-2026-16264.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/aiosendletter
- https://github.com/ossf/malicious-packages/blob/b4f738c2719bc533615f8c2b6a5ab143ced7546b/osv/malicious/pypi/aiosendletter/MAL-2026-16264.json
- https://github.com/ossf/malicious-packages/blob/3993d521acd1486d7f417803e3ab35e8ab0de7a0/osv/malicious/pypi/aiosendletter/MAL-2026-16264.json
- https://pypi.org/project/aiosendletter/4.3
- https://pypi.org/project/aiosendletter/4.6
- https://github.com/ossf/malicious-packages/blob/44c218ef24cf0a946ee5662e20e1cd59a1e6a7b6/osv/malicious/pypi/aiosendletter/MAL-2026-16264.json
- https://pypi.org/project/aiosendletter/0.2.0
- https://pypi.org/project/aiosendletter/3.7

Compromised versions (1)

= 0.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.