From PyPI to the Dark Marketplace: How a Malicious Package Fuels the Sale of Telegram Identities

Three malicious Python packages—Quicolor, QuickColors and ColorYi—were discovered on PyPI, masquerading as legitimate color formatting libraries. These packages exfiltrate Telegram Desktop's tdata folder.