pypi
Malicious callistopy @0.3.91
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 3:33 PM UTC
OSV ID
MAL-2025-191698
Ecosystem
pypi
Summary
Package creates a telegram client which silently exfiltrate user's Telegram data, including sessions and configuration, to a hardcoded remote target --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-callistopy Reasons (based on the campaign): - exfiltration-generic - action-hidden-in-lib-usage
Source: kam193 (c45e190afdbbb8d4b817c50734f8b01bc3bec65978141d4070ca2ec60be6b061)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.