ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android
Severity: critical · Patch status: no-fix-needed · Since 2026-11-14
The PyPI package ps-bool was found to contain malicious code: on import, obfuscated code exfiltrates photos and documents to an attacker-controlled Telegram bot, with targeting of Android devices. Versions 0.2.0, 0.2.1, 0.2.3, 0.2.4 and 0.2.5 are affected, with no clean version available. The advisory was published to the GitHub Advisory Database on 2026-11-14, credited to researcher kam193 via OpenSSF's malicious-packages database. Anyone who installed or imported ps-bool, particularly on Android environments, should assume file exfiltration occurred. There is no fix; the package should be treated as malware and removed entirely.
What to do
- Remove ps-bool from all environments and dependency manifests immediately; do not upgrade within the package
- Audit systems where it was installed for exfiltrated photos/documents and review Telegram bot traffic and egress logs
- Rotate any credentials or sensitive data accessible from affected devices, especially Android devices
- Check lockfiles and CI caches for residual copies and block the package name in your registry proxy
Sources
All live incidents on Threat Watch
