heroku-tl

MAL-2025-2967

Malicious code in heroku-tl (PyPI)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (8a78aff2389300306864bb3d44e1ac70675e128845a4d734dae5ffbc39076b93)
Clone of a legit Telegram client, with a hidden code that, under some conditions, can attempt to destroy the Linux OS.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-03-heroku-tl


Reasons (based on the campaign):


 - clones-real-package


 - action-hidden-in-lib-usage

Compromised versions (15)

3.2.0
3.2.1
3.2.2
3.2.5
2.1.0
2.1.1
2.2.2
2.5.0
2.5.1
2.6.0
2.8.0
2.9.0
3.0.0
3.0.1
3.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.