{"id":"MAL-2025-191535","kind":"package","aliases":["MAL-2025-191535"],"related":[],"title":"Malicious code in tableate (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (762292d92c617c287b3c6b54f7c4a8b8630e7dd893b40dd05bade462fec7ca26)\nThis package is malicious and typosquating the legitimate pyspellchecker library.\nThis package will deploy a remote-access trojan that allows the attacker full\ncontrol of the victim's host.\n\n## Source: kam193 (d88deb1f1ae46e472c6b11ee1f67a1625ed092c81dc62ce54491c775e719748e)\nPackages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for next code to execute\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-11-spellcheckers\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"tableate","fixed":[],"affected":"all versions","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2025-11-25T11:06:37+00:00","first_seen_at":"2026-10-30T10:28:28+00:00","triaged_at":"2026-10-30T10:28:57+00:00","updated_at":"2026-10-30T10:28:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':114C '-191535':8A,11A '-2025':7A,10A '2025':113C '762292d92c617c287b3c6b54f7c4a8b8630e7dd893b40dd05bade462fec7ca26':30C 'access':48C 'allow':51C 'attack':53C 'background':88C 'base':117C 'campaign':105C,112C,120C 'categori':102C 'clear':107C 'code':2A,67C,82C,99C,132C 'command':136C 'connect':90C 'contain':65C,131C 'control':55C 'd88deb1f1ae46e472c6b11ee1f67a1625ed092c81dc62ce54491c775e719748e':63C 'deploy':44C 'detail':17C 'download':79C,122C 'edit':20C 'effect':70C 'execut':101C,124C,134C 'full':54C 'googl':26C 'google-open-source-secur':25C 'hidden':66C 'host':60C,94C 'import':73C 'infosteal':111C 'intent':109C 'kam193':62C 'legitim':38C 'librari':40C,77C 'like':110C 'limit':138C 'line':23C 'machin':147C 'mal':6A,9A 'malici':1A,13B,34C,103C,108C,127C 'next':98C 'obfusc':121C 'open':27C 'packag':14B,32C,42C,64C,130C 'per':15C 'period':89C 'probabl':137C 'process':85C 'pypi':5A 'pyspellcheck':39C 'reason':116C 'remot':47C,93C,126C,135C 'remote-access':46C 'run':71C,86C 'script':128C 'second':80C 'secur':29C 'set':142C 'sourc':16C,24C,28C,61C 'specif':141C 'spellcheck':115C 'stage':81C 'tableat':4A 'tableate':12A 'trojan':49C 'typosqu':36C 'use':75C 'victim':58C,145C 'wait':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2025-11-25T11:06:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2025-191535","url":"https://osv.dev/vulnerability/MAL-2025-191535","severity":"critical","published_at":"2025-11-25T11:06:37+00:00","modified_at":"2026-10-30T09:45:04+00:00","first_seen_at":"2026-10-30T10:28:28+00:00","fetched_at":"2026-10-30T10:28:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}