Supply chain · pip · High

Malicious 'zmaker' (PyPI) Package Part of Telegram Data Exfiltration Campaign

Threat Engine Auto-Feed · data current as of 2026-07-21

The 'zmaker' package on PyPI is identified as a component of a multi-package campaign designed to exfiltrate data from the Telegram Desktop application. Organizations using 'zmaker' version 1.0.3 are exposed to potential credential and secret theft, necessitating immediate review and remediation.

  • Package: pip / zmaker
  • Affected versions: = 1.0.3
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The 'zmaker' package (version 1.0.3) on PyPI contains malicious code. It is part of a coordinated campaign involving several other packages ('pyapiepo', 'zscaner', 'reqinstall', 'zsender') that collectively target and exfiltrate user data from the Telegram Desktop application.

How the attack works

This supply-chain attack leverages multiple interconnected malicious packages. When installed, these packages work in concert to locate specific application data directories, archive the contents, and then exfiltrate the collected information to a remote location. The 'zmaker' package specifically provides functions to build archives from collected files.

Who's exposed

Profiles most at risk

  • Development teams using the PyPI ecosystem
  • Organizations whose CI/CD pipelines pull Python dependencies
  • Any user or system that has installed 'zmaker' version 1.0.3

Conditions that increase exposure

  • Unpinned dependencies that could inadvertently pull the malicious version
  • Lack of dependency lockfiles in projects
  • Use of internal mirrors that may not have updated blocklists for malicious packages
  • Direct or transitive dependency on 'zmaker' version 1.0.3

Blast-radius scenarios

  • If 'zmaker' 1.0.3 is installed, an attacker can achieve unauthorized access to sensitive user data from the Telegram Desktop application.
  • The blast radius includes any system where the malicious package is executed, potentially leading to compromise of user accounts and data associated with Telegram.

What to do (defensive)

Detect

  • Scan dependency trees for 'zmaker' version 1.0.3.
  • Monitor network traffic for unusual outbound connections from development or production systems that have installed Python packages.
  • Review package installation logs for 'zmaker' 1.0.3 or any of the related malicious packages ('pyapiepo', 'zscaner', 'reqinstall', 'zsender').

Contain

  • Immediately quarantine or isolate any systems identified with 'zmaker' version 1.0.3 installed.
  • Block 'zmaker' version 1.0.3 (and related packages) from being pulled from PyPI or internal mirrors.
  • Review and update dependency pinning to specific, known-good versions across all projects.

Remediate

  • Remove 'zmaker' version 1.0.3 and any related malicious packages from all affected environments.
  • Force password resets and invalidate tokens for any accounts potentially exposed through compromised Telegram Desktop data.
  • Conduct a thorough audit of systems where the package was installed to identify any further compromise or persistence mechanisms.
  • Implement strict dependency versioning and lockfiles to prevent similar incidents.

Frontier verdict — High

Prioritize immediate detection and removal of 'zmaker' 1.0.3 due to its role in a critical credential/secret theft campaign targeting Telegram Desktop data.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.