Malicious Code Detected in pycolorom: Remote Control Vulnerability
Summary
MAL-2026-96: Malicious code in pycolorom (PyPI). Affects pycolorom versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pycolorom package, available on PyPI, is purportedly a speed testing or typosquatted Telegram library. It is designed to facilitate interactions with Telegram bots. However, this package has been identified as containing malicious code that allows for remote control of the user's computer, posing significant security risks.
Vulnerability Detail
The vulnerability stems from a malicious campaign identified as '2025-10-speedd-testing-bot'. The package downloads and executes a remote malicious script, effectively turning the user's machine into a remote access tool (RAT). This poses severe risks, including unauthorized access to sensitive information and potential system compromise. The malicious code was introduced by a user identified as 'kam193', and the specific version affected is 1.0.1.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pycoloromIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the pycolorom package altogether. If you require similar functionality, consider using alternative libraries that are well-reviewed and have a strong security track record. Always verify the source of any package before installation.
Conclusion
The pycolorom package has been identified as containing malicious code that poses significant security risks by enabling remote control of affected systems. Users are advised to uninstall the package immediately and consider alternatives. Regular monitoring for vulnerabilities is essential for maintaining software security.
See every vulnerability recorded for pycolorom →
FAQ
pycolorom is a package available on PyPI, initially presented as a speed testing or Telegram library, but it has been identified to contain malicious code.
The vulnerability allows malicious actors to remotely control your computer, potentially leading to unauthorized access to sensitive data and system compromise.
If you have installed pycolorom, immediately uninstall it using 'pip uninstall pycolorom' and refrain from reinstalling it or any similar packages from untrusted sources.
Yes, consider using alternative libraries that provide similar functionalities but are verified and trusted. Always check the package's reputation before installation.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
