Poisoned Pipeline

Poisoned Pipeline / Incidents / AS156

AS156 · 2026-06

Operation Navy Ghost fake pyrogram packages on PyPI

PyPI

Checkmarx Zero: attackers planted a Telegram-powered backdoor across
fake pyrogram packages on PyPI (Operation Navy Ghost).

Mapped techniques

supply-chain fake telegram sdk

T0129 · Initial Access · Typosquatting

Fake pyrogram packages.

T0109 · Resource Development · Publish malicious artifact

PyPI campaign.

T0172 · Execution · Runtime backdoor

Telegram-powered backdoor.

Sources