Malicious ‘Pyronut’ Package Backdoors Telegram Bots With Remote Code Execution

**Executive Summary:** A malicious PyPI package called `pyronut` posed as the pyrogram framework and contained a hidden runtime backdoor (pyrogram/helpers/secret.py) that activated on Client.start(), registering Telegram handlers that allowed arbitrary Python execution and shell command execution; three malicious versions (2.0.184–2.0.186) were published on 2026-03-18 and quarantined the same day, but any developers who executed the package were at risk of credential theft, data exfiltration, and full Telegram session compromise.