Malicious Code Detected in aiogrem Package: Remote Control Vulnerability
Summary
MAL-2025-193007: Malicious code in aiogrem (PyPI). Affects aiogrem versions 0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aiogrem package, available on PyPI, is designed for speed testing and is suspected to be a typosquatted library masquerading as a Telegram bot. Its intended functionality is to facilitate communication and control via Telegram, but it has been compromised to include malicious code that allows remote control of the user's computer.
Vulnerability Detail
The vulnerability in the aiogrem package originates from a malicious campaign identified as '2025-10-speedd-testing-bot'. This package has been found to contain a Remote Access Trojan (RAT) that downloads and executes a remote malicious script on the victim's machine. The malicious intent is clear, as it can lead to unauthorized access and control over the affected system, posing significant security risks to users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall aiogremIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the aiogrem package from their environment using the command: 'pip uninstall aiogrem'. Additionally, users should monitor their systems for any unusual activity and consider using security software to detect and remove any potential threats.
Conclusion
The aiogrem package has been identified as malicious, posing significant risks to users through remote control capabilities. It is crucial to uninstall the package and monitor for any unusual activity. Users are encouraged to utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for aiogrem →
FAQ
aiogrem is a Python package available on PyPI, primarily intended for speed testing and communication via Telegram.
The package was compromised through a malicious campaign that introduced a Remote Access Trojan (RAT) capable of executing remote scripts.
If you have aiogrem installed, you should uninstall it immediately and monitor your system for any unusual activity.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without requiring access to the code. Visit Vulert Scanner to check your application.
The risks include unauthorized access to your computer, potential data theft, and the execution of malicious scripts that can compromise your system's security.
