Malicious Package

Overview ukraine69 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in ukraine69 (PyPI)

Source: kam193 751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-17919 Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...

Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...