Malicious Code Exfiltration in zscaner Package
Summary
MAL-2025-191944: Malicious code in zscaner (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zscaner package, available on PyPI, is designed to facilitate data scanning and archiving. However, it has been identified as part of a malicious campaign that targets user data from the Telegram Desktop application. The package operates by scanning directories, filtering files, and exfiltrating sensitive information to a remote server, posing a significant risk to user privacy and data security.
Vulnerability Detail
The vulnerability originates from the intentional inclusion of malicious code within the zscaner package. When imported, zscaner automatically executes a function that initiates a data exfiltration process targeting the Telegram Desktop folder. This process involves scanning for user data, archiving it, and sending it to a remote server, which can lead to unauthorized access to sensitive information and potential identity theft.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall zscanerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can manually delete the zscaner package from your system using the command: pip uninstall zscaner. Additionally, consider using alternative packages that do not exhibit malicious behavior.
Conclusion
The zscaner package poses a significant security threat due to its malicious code designed to exfiltrate user data from the Telegram Desktop application. Users are advised to uninstall the package and monitor their systems for any unauthorized access. Regular updates and security checks are essential to maintaining a secure environment.
See every vulnerability recorded for zscaner →
FAQ
zscaner is a Python package designed for scanning and archiving files, but it has been compromised to exfiltrate user data from the Telegram Desktop application.
The malicious code in zscaner executes automatically upon import, scanning for user data in the Telegram Desktop folder and sending it to a remote server.
The risks include unauthorized access to sensitive user data, potential identity theft, and loss of privacy.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed zscaner, immediately uninstall it using the command: pip uninstall zscaner, and monitor your system for any unusual activity.
