Attackers Planted a Telegram-Powered Backdoor Across Fake Pyrogram Packages
Attackers uploaded malicious Pyrogram packages (a Telegram API client library) to PyPI, embedding a Telegram-controlled backdoor called "Navy Ghost." The fake packages exfiltrated data and executed remote commands, targeting developers in a supply-chain attack. Checkmarx researchers uncovered the operation, warning of persistent risks in open-source ecosystems.
Background
- Pyrogram is an open-source Python library used by developers to build custom apps that interact with Telegram's messaging platform. It was recently (April 2025) acquired by Telegram itself.
- Checkmarx researchers uncovered a supply-chain attack in which unknown attackers published fake, malicious Pyrogram packages on the official Python Package Index (PyPI, the main repository for Python code). The malicious packages were almost identical to the real Pyrogram but contained stealthy backdoor code that let attackers remotely control infected machines via Telegram commands.
- "Supply-chain attack" means the bad code is planted inside a trusted, commonly used software component; anyone who installs the malicious package unintentionally infects their own system, potentially compromising the developer's machine, cloud credentials, or the software they ship to their own users.
- This incident highlights ongoing security risks in open-source package ecosystems (PyPI, npm, etc.), where typosquatting — registering packages with names very close to popular ones — tricks developers into downloading malware.