Pyronut Package Backdoors Telegram Bots With RCE

The report describes 'Pyronut', a malicious PyPI package impersonating the Pyrogram Telegram framework; three malicious versions (2.0.184–2.0.186) were published and rapidly quarantined. Pyronut modifies the pyrogram Client.start() flow to import a hidden backdoor module that registers handlers for remote Python evaluation and shell execution, enabling attackers to execute arbitrary code, steal keys/credentials, and pivot from compromised Telegram bot sessions. Detection and response guidance includes scanning dependency manifests for pyronut, flagging unexpected use of the meval library, checking for Python-spawned /bin/bash -c processes, revoking Telegram tokens, rotating exposed secrets, and rebuilding affected environments.