Malicious Code Vulnerability in pullgetsage Package: Telegram Account Takeover Risk
Summary
MAL-2026-16366: Malicious code in pullgetsage (PyPI). Affects pullgetsage versions 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pullgetsage package is a library available on PyPI, purportedly designed to provide access to a collection of books. However, it has been found to contain malicious code that compromises user security. The package's misleading identifiers and unrelated stated purpose obscure its true functionality, which involves unauthorized data transmission.
Vulnerability Detail
The vulnerability originates from the package's init.py file, which archives the Telegram Desktop tdata directory containing sensitive session keys and uploads it to a hardcoded Cloudflare Workers endpoint. This behavior allows attackers to take over the installer's Telegram account, posing a significant security risk. The malicious actions are disguised with misleading identifiers and empty exception handling, making detection difficult.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pullgetsageIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users are advised to avoid using the pullgetsage package and look for alternative libraries that do not pose security risks. Additionally, monitor your Telegram account for any unauthorized access.
Conclusion
The pullgetsage package contains a serious vulnerability that can lead to the compromise of Telegram accounts. Users are strongly advised to uninstall the package and remain vigilant for any unauthorized access to their accounts. Regular updates and monitoring for vulnerabilities are essential for maintaining security.
See every vulnerability recorded for pullgetsage →
FAQ
The pullgetsage package is a library on PyPI that claims to provide access to a collection of books, but it has been found to contain malicious code.
The vulnerability allows the package to upload sensitive Telegram session data to an external server, enabling account takeover.
Uninstall the pullgetsage package immediately and monitor your Telegram account for any suspicious activity.
Currently, there is no patched version available. Users should uninstall the package until a secure version is released.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
