Malicious code in extera-runtime (PyPI)
MAL-2026-18633
Published · Modified
Dependency scanning
Check whether extera-runtime is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: kam193 (400bf2ff64fec2a3d26fa477d19f25b0d2abfdc40ae5247531a128cfdc41aa19)
The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-extera-plugin-runtime
Reasons (based on the campaign):
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
files-exfiltration
target:telegram
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes