MalwarePublished 28 Jan 2026Updated 30 Oct 2026

tabullates (PyPI) · Malicious Code

Affects tabullatesSource GCVE Database

Malicious package : remove tabullates and rotate any secrets on hosts that installed it.

Data as of 30 Oct 2026, 10:21 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-562

What to do

Remove tabullates from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPItabullates	Affected 1.0.1 – 1.0.4 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'tabullates' versions 1.0.1 through 1.0.4 contains hidden malicious code that executes upon import or use. This code downloads additional malicious scripts and runs a background process that periodically connects to a remote host to receive further commands. The package is designed to execute remote commands on the victim's machine, indicating clear malicious intent.

Impact

Infected systems running these versions of 'tabullates' are subject to unauthorized remote code execution and persistent remote control. This can lead to data theft, system compromise, and further malicious activities as dictated by the remote attacker. The presence of a background process connecting to a remote host increases the risk of ongoing exploitation and data exfiltration.

Defensive guidance

Users should immediately uninstall affected versions 1.0.1 through 1.0.4 of the 'tabullates' package and avoid using this package until a clean, verified version is available. Monitor for any unusual network activity related to this package and consider scanning affected systems for signs of compromise.

Summary

The 'tabullates' package on PyPI, specifically versions 1.0.1, 1.0.2, 1.0.3, and 1.0.4, contains obfuscated code that activates during import or usage. This code downloads a second-stage payload and establishes a persistent background process that periodically communicates with a remote server to receive and execute further commands. The capability to execute remote commands suggests this package functions as malware with potential for remote control over infected systems.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 10:21 UTC

Technical details

References

Community reviews