Malicious Code Detected in Pyrogrqm Package: Remote Control Threat
Summary
MAL-2025-193010: Malicious code in pyrogrqm (PyPI). Affects pyrogrqm versions 0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pyrogrqm package, available on PyPI, is marketed as a speed testing tool or a Telegram library. However, it has been identified as a typosquatted package that masquerades as a legitimate library while embedding malicious functionalities. This package is designed to facilitate remote control of the user's computer through a Telegram bot, posing significant security risks.
Vulnerability Detail
The vulnerability originates from the malicious intent behind the pyrogrqm package, which is part of a campaign identified as '2025-10-speedd-testing-bot'. This package acts as a Remote Access Trojan (RAT), capable of downloading and executing remote scripts without user consent. The malicious code can lead to unauthorized access to sensitive information and control over the victim's system, making it a severe security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pyrogrqmIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the pyrogrqm package altogether. Instead, consider using verified alternatives for speed testing or Telegram functionalities. Always verify the authenticity of packages before installation.
Conclusion
The pyrogrqm package poses a significant security threat due to its malicious functionalities, allowing remote control of affected systems. Users are advised to uninstall the package immediately and consider using trusted alternatives. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software security.
See every vulnerability recorded for pyrogrqm →
FAQ
The pyrogrqm package is a speed testing tool or a Telegram library that has been identified as malicious due to its ability to control computers remotely.
If you have installed the pyrogrqm package, your system may be at risk. You can check for vulnerabilities using tools like Vulert, which monitors open-source vulnerabilities in real-time.
Immediately uninstall the pyrogrqm package using 'pip uninstall pyrogrqm' to mitigate any potential risks.
Yes, consider using verified packages for speed testing or Telegram functionalities that do not have known vulnerabilities.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring code access. You can check your application against known vulnerabilities using the Vulert playground.
