Remote Command Execution Vulnerability in dakhara Package
Summary
MAL-2026-1235: Malicious code in dakhara (PyPI). Affects dakhara versions 0.0.1 – 0.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dakhara package, available on PyPI, is designed to facilitate interactions with Telegram bots. It allows users to automate tasks and execute commands remotely. However, this package has been found to contain malicious code that compromises user security by executing unauthorized commands on the victim's machine.
Vulnerability Detail
The vulnerability originates from malicious code embedded in the dakhara package, specifically versions 0.0.1 to 0.0.4. When the package is installed, it automatically initiates a Telegram bot that listens for remote commands. The bot's credentials are dynamically retrieved from a pastebin link, allowing attackers to execute commands on the victim's machine. This poses significant risks, including unauthorized access to sensitive information and potential system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall dakharaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can block the Telegram bot's communication by modifying their firewall settings to prevent outgoing connections to the pastebin URL: https://pastebin.com/raw/nbEuX2hW.
Conclusion
The dakhara package has been identified as containing malicious code that enables remote command execution, posing serious security risks. Users are urged to uninstall the affected versions and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for dakhara →
FAQ
The dakhara package is a Python library designed for automating interactions with Telegram bots.
The vulnerability allows attackers to execute remote commands on your machine, potentially leading to unauthorized access and data theft.
Versions 0.0.1 to 0.0.4 of the dakhara package are known to contain the malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Uninstall the dakhara package immediately and monitor for any updates or patches from the official repository.
