MalwarePublished 23 Jan 2026Updated 30 Oct 2026

tableates (PyPI) · Malicious Code

Affects tableatesSource GCVE Database

Malicious package : remove tableates and rotate any secrets on hosts that installed it.

Data as of 30 Oct 2026, 10:22 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-492

What to do

Remove tableates from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPItableates	Affected 1.0.1 – 1.0.6 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'tableates' versions 1.0.1 through 1.0.6 contain hidden malicious code that executes upon import or use. This code downloads additional malicious scripts and runs a background process that periodically connects to a remote host to receive further commands. The package is designed to execute remote commands on the victim's machine, indicating clear malicious intent.

Impact

Systems that install or use the affected versions of the 'tableates' package may have malicious code executed without user consent. This can lead to unauthorized remote command execution, persistent backdoor access, and potential data compromise or system manipulation. The presence of a background process connecting to a remote host increases the risk of ongoing control and further payload delivery.

Defensive guidance

Users should immediately uninstall the affected versions of the 'tableates' package (1.0.1 through 1.0.6) and avoid using this package from PyPI. Monitoring for network connections to suspicious remote hosts is advised. Consider using trusted package sources and verifying package integrity before installation.

Summary

The 'tableates' Python package, specifically versions 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, and 1.0.6, contains obfuscated code that runs automatically when the package is imported or used. This code downloads a second-stage payload and establishes a persistent background process that periodically connects to a remote server to await further instructions. The package can execute remote commands on the infected system, likely limited to a specific command set. This behavior classifies the package as malware with clear intent to compromise affected systems.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 10:22 UTC

Technical details

References

Community reviews