Malicious Code Exfiltration in zsender Package
Summary
MAL-2025-191945: Malicious code in zsender (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The zsender package, part of a malicious campaign targeting Telegram Desktop users, is designed to exfiltrate sensitive user data. It operates by scanning directories for user data, archiving it, and sending it to a remote server. The package is a dependency in a series of malicious packages that collectively aim to compromise user privacy.
Vulnerability Detail
The zsender package contains malicious code that is intentionally included to facilitate data exfiltration from the Telegram Desktop application. This vulnerability originates from a campaign that splits functionality across multiple packages, with zsender specifically responsible for sending the collected data to a remote server. The malicious code is executed automatically upon import, making it a significant threat to user data security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall zsenderIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the zsender package and its dependencies. Ensure that your environment does not include any packages from the malicious campaign. You can also monitor your system for unusual activity and remove any suspicious files or directories.
Conclusion
The zsender package poses a serious threat due to its malicious intent to exfiltrate user data from Telegram Desktop. Users are advised to remove the package and its dependencies immediately and to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for zsender →
FAQ
The zsender package is part of a malicious campaign designed to exfiltrate user data from the Telegram Desktop application.
The vulnerability allows attackers to access and exfiltrate sensitive user data without consent, posing a significant privacy risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without signing up.
Remove the zsender package and any related malicious packages immediately to protect your data.
Yes, Vulert provides tools to monitor open-source vulnerabilities in your software using just the Pipfile.lock.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
