Critical Malicious Code Vulnerability in aiogram-sever-patch Package
Summary
MAL-2025-192931: Malicious code in aiogram-sever-patch (PyPI). Affects aiogram-sever-patch versions 3.3.7 – 3.3.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aiogram-sever-patch package is a Python library designed for building asynchronous Telegram bots using the Aiogram framework. It provides various functionalities to facilitate bot development, including handling updates and managing user interactions. However, this package has been found to contain malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious implementation within the aiogram-sever-patch package, specifically in its setup.py file, which overrides the install command to execute harmful code during installation. This code initiates a reverse shell to a hardcoded IP address, allowing attackers to execute arbitrary commands on the victim's machine. The malicious intent is clear, as it can lead to unauthorized access and control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aiogram-sever-patchIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can block outbound connections to the malicious IP address (147.45.124.42) to mitigate the risk of exploitation until the package is removed or patched.
Conclusion
The aiogram-sever-patch package contains a critical vulnerability that allows for the execution of malicious code on users' machines. Immediate action is required to uninstall the package and mitigate potential risks. Users are encouraged to monitor their dependencies and utilize tools like Vulert for ongoing security assessments.
See every vulnerability recorded for aiogram-sever-patch →
FAQ
The aiogram-sever-patch package is a Python library used for developing asynchronous Telegram bots with the Aiogram framework.
The vulnerability allows attackers to execute arbitrary commands on your system through a reverse shell, potentially leading to unauthorized access and control.
You should uninstall the aiogram-sever-patch package immediately and consider using alternative packages for your Telegram bot development.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using the Pipfile.lock. You can check your application for vulnerabilities using the Vulert playground without signup.
Regularly updating your dependencies, using trusted sources, and employing tools like Vulert for real-time monitoring can help prevent vulnerabilities.
