Malicious Code in telebot-infoo: Remote Control Vulnerability
Summary
MAL-2026-935: Malicious code in telebot-infoo (PyPI). Affects telebot-infoo versions 0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'telebot-infoo' is a Python library available on PyPI, designed for interacting with the Telegram messaging platform. It is intended to facilitate the creation of Telegram bots. However, this package has been identified as a speed testing tool that is actually a typosquatted version of a legitimate library, containing malicious code that allows for remote control of the user's computer.
Vulnerability Detail
The vulnerability originates from the malicious intent behind the 'telebot-infoo' package, which is a result of typosquatting. The package downloads and executes a remote malicious script, effectively turning the user's machine into a remote access trojan (RAT). This poses significant risks, including unauthorized access to sensitive data and control over the affected system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall telebot-infooIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate the risks posed by this malicious package. The best course of action is to remove the package and use a verified alternative.
Conclusion
The 'telebot-infoo' package poses a significant security risk due to its malicious code that enables remote control of affected systems. Users are strongly advised to uninstall this package and switch to verified alternatives to safeguard their systems.
See every vulnerability recorded for telebot-infoo →
FAQ
'telebot-infoo' is a Python package that was intended to be a Telegram bot library but has been identified as malicious.
The vulnerability allows attackers to execute remote scripts on your machine, potentially leading to unauthorized access and control.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should uninstall 'telebot-infoo' immediately and replace it with a legitimate library like 'python-telegram-bot'.
Typosquatting is a malicious practice where attackers create fake packages with names similar to legitimate ones to deceive users into installing them.
